theory Deterministic_AI

lemma (in mdb_empty_abs') next_not_child:
  notes split_paired_All[simp del] split_paired_Ex[simp del]
  shows "\<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m\<rbrakk>
    \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n
     = (if p = slot then None
       else if next_not_child p t m = Some slot then next_slot slot t m
       else next_not_child p t m)" apply(case_tac "p=slot") apply(simp) apply(rule next_not_child_NoneI) apply(fastforce simp: next_sib descendants) apply(simp add: next_sib) apply(simp add: finite_depth) apply(case_tac "next_not_child p t m = Some slot") apply(simp) apply(simp add: next_slot_def) apply(intro conjI impI) apply(subgoal_tac "\<exists>c. next_child slot t = Some c") prefer 2 apply(case_tac "t slot") apply(simp add: next_child_def) apply(simp add: next_child_def) apply(erule exE) apply(simp) apply(drule(1) next_not_childD, simp add: no_mloop) apply(rule next_not_childI) apply(erule disjE) apply(simp add: next_sib) apply(rule disjI2) apply(elim exE conjE) apply(subgoal_tac "p \<notin> descendants_of slot m") prefer 2 apply(rule notI) apply(drule next_sibD) apply(elim exE conjE) apply(drule_tac a=p and b=slot and c=q in descendants_linear) apply(simp) apply(rule notI, simp add: after_in_list_not_self valid_list_2_def) apply(drule after_in_list_in_list) apply(simp add: valid_list_2_def) apply(subgoal_tac "pa \<in> descendants_of pa m") prefer 2 apply(simp add: descendants_of_def cdt_parent_defs) apply(erule disjE) apply(rule_tac b=q in trancl_into_trancl2) apply(simp) apply(drule_tac x=q and y=slot in tranclD2) apply(simp) apply(drule rtranclD) apply(fastforce) apply(rule_tac b=slot in trancl_into_trancl2) apply(simp) apply(drule_tac x=slot and y=q in tranclD2) apply(simp) apply(drule rtranclD) apply(fastforce) apply(insert valid_mdb)[1] apply(drule_tac slot=pa in desc_not_parent, simp add: m_def) apply(subgoal_tac "m p \<noteq> Some slot") prefer 2 apply(rule notI) apply(fastforce simp: descendants_of_def cdt_parent_defs) apply(rule conjI) apply(simp add: next_sib) apply(rule_tac x=q in exI) apply(simp add: descendants) apply(intro conjI impI notI) apply(simp) apply(simp add: next_sib) apply(intro allI impI) apply(subgoal_tac "m q' \<noteq> Some slot") prefer 2 apply(rule notI) apply(drule next_sibD) apply(elim exE conjE, drule after_in_list_in_list) apply(simp add: valid_list_2_def) apply(subgoal_tac "pa \<in> descendants_of pa m") prefer 2 apply(simp add: descendants_of_def cdt_parent_defs) apply(rule_tac b=q in trancl_into_trancl2) apply(simp) apply(elim conjE) apply(drule_tac x=q and y=q' in tranclD2) apply(simp) apply(drule rtranclD) apply(simp) apply(drule_tac x=q and y=slot in tranclD2) apply(simp) apply(drule rtranclD) apply(fastforce) apply(insert valid_mdb)[1] apply(drule_tac slot=pa in desc_not_parent, simp add: m_def) apply(simp add: next_sib) apply(simp add: finite_depth) apply(case_tac "next_not_child slot t m") apply(simp) apply(drule(1) next_not_child_NoneD) apply(drule(1) next_not_childD, simp add: no_mloop) apply(rule next_not_child_NoneI) apply(intro impI allI) apply(simp add: next_sib' descendants split: if_split_asm) apply(erule disjE) apply(drule_tac c=q in next_sib_share_parent, simp) apply(fastforce) apply(elim conjE exE) apply(rule impI) apply(drule_tac a=p and b=qa and c=q in descendants_linear) apply(simp) apply(fastforce) apply(erule disjE) apply(drule_tac c=q in next_sib_share_parent, simp) apply(fastforce) apply(fastforce) apply(fastforce simp: next_sib') apply(simp add: finite_depth) apply(simp) apply(drule(1) next_not_childD, simp add: no_mloop)+ apply(elim disjE conjE exE) apply(rule next_not_childI) apply(simp add: next_sib') apply(simp add: finite_depth) apply(frule_tac a=p and c=q in next_sib_share_parent, simp) apply(rule next_not_childI) apply(simp add: next_sib' descendants) apply(rule_tac x=q in exI) apply(simp) apply(frule_tac a=slot and c=a in desc_sib_ne) apply(simp) apply(simp) apply(simp add: no_mloop) apply(simp) apply(rule conjI) apply(rule notI) apply(simp add: no_mloop no_mloop_descendants) apply(intro impI allI) apply(elim conjE) apply(drule_tac a=p and c=q' in next_sib_share_parent, simp) apply(simp) apply(simp add: finite_depth) apply(rule next_not_childI) apply(simp add: next_sib') apply(rule_tac x=q in exI) apply(simp add: descendants) apply(intro conjI impI allI notI) apply(frule next_sibD) apply(simp add: not_sib_self) apply(simp) apply(simp add: finite_depth) apply(rule next_not_childI) apply(simp add: next_sib') apply(rule_tac x=qa in exI) apply(simp add: descendants) apply(frule_tac a=slot and b=qa and c=a in desc_sib_ne) apply(simp) apply(simp) apply(simp add: no_mloop) apply(simp) apply(frule_tac a=q and c=qa in next_sib_share_parent) apply(simp) apply(simp) apply(intro conjI impI allI notI) apply(simp) apply(rule_tac b=q in descendants_trans) apply(simp) apply(simp) apply(erule conjE) apply(case_tac "q=q'") apply(simp) apply(frule_tac a=p and b=q and c=q' in descendants_linear) apply(simp) apply(simp) apply(erule disjE) apply(drule_tac a=q and c=q' in next_sib_share_parent) apply(simp) apply(fastforce) apply(fastforce) apply(simp add: finite_depth) apply(simp) apply(case_tac "next_not_child p t m") apply(simp) apply(drule(1) next_not_child_NoneD) apply(erule conjE) apply(rule next_not_child_NoneI) apply(intro allI impI) apply(simp add: next_sib descendants split: if_split_asm) apply(intro impI conjI) apply(simp add: valid_list_2_def) apply(erule conjE) apply(erule_tac x=slot in allE)+ apply(fastforce) apply(drule_tac a=p and b=q and c=slot in descendants_trans) apply(fastforce simp: descendants_of_def cdt_parent_defs) apply(simp) apply(simp add: next_sib) apply(erule_tac x=slot in allE) apply(fastforce simp: descendants_of_def cdt_parent_defs) apply(simp add: finite_depth) apply(simp) apply(drule(1) next_not_childD, simp add: no_mloop) apply(erule disjE) apply(frule next_sibD) apply(rule next_not_childI) apply(rule disjI1) apply(fastforce simp: next_sib) apply(simp add: finite_depth) apply(elim conjE exE) apply(rule next_not_childI) apply(case_tac "q=slot \<and> m p = Some slot") apply(rule disjI1) apply(simp add: next_sib) apply(drule next_sib_NoneD, simp, simp) apply(rule disjI2) apply(rule conjI) apply(simp add: next_sib) apply(rule impI) apply(erule conjE) apply(frule_tac a=p and b=q and c=slot in descendants_linear) apply(simp add: child_descendant) apply(simp) apply(erule disjE) apply(simp add: descendants_of_def cdt_parent_defs) apply(drule tranclD2, simp) apply(drule rtranclD, simp) apply(drule_tac x=slot and y=q and z=slot in trancl_trans) apply(simp) apply(insert no_mloop)[1] apply(simp add: no_mloop_def cdt_parent_defs) apply(simp add: child_descendant) apply(case_tac "q=slot") apply(simp) apply(subgoal_tac "\<exists>c. m c = Some slot \<and> p \<in> descendants_of c m") prefer 2 apply(simp add: descendants_of_def cdt_parent_defs) apply(drule tranclD) apply(elim exE conjE) apply(rule_tac x=z in exI) apply(simp) apply(drule rtranclD) apply(fastforce) apply(elim exE conjE) apply(rule_tac x=c in exI) apply(rule conjI) apply(simp add: next_sib) apply(subgoal_tac "next_sib c t m = None") prefer 2 apply(erule_tac x=c in allE) apply(erule_tac Q="next_sib c t m = None" in impE) apply(simp add: child_descendant) apply(simp) apply(simp) apply(intro conjI impI) apply(fastforce) apply(fastforce) apply(frule_tac slot=c in next_sib_NoneD, simp) apply(rule conjI) apply(simp add: descendants) apply(fastforce) apply(intro allI impI) apply(simp add: next_sib descendants split: if_split_asm) apply(subgoal_tac "next_sib q' t m = None") prefer 2 apply(erule_tac x=q' in allE) apply(erule_tac Q="next_sib q' t m = None" in impE) apply(simp) apply(rule_tac b=c in descendants_trans) apply(simp) apply(simp add: child_descendant) apply(simp) apply(simp) apply(intro conjI impI notI) apply(simp add: valid_list_2_def, erule conjE) apply(erule_tac x=slot in allE)+ apply(fastforce) apply(erule conjE) apply(simp add: descendants_of_def cdt_parent_defs) apply(drule_tac x=c and y=q' in tranclD2) apply(simp) apply(drule rtranclD) apply(simp) apply(drule_tac a=c and b=slot and c=c in trancl_into_trancl) apply(simp) apply(insert no_mloop)[1] apply(simp add: no_mloop_def cdt_parent_defs) apply(rule_tac x=q in exI) apply(intro conjI) apply(simp add: next_sib) apply(frule next_sibD) apply(intro conjI impI) apply(simp) apply(simp add: descendants) apply(intro allI impI) apply(simp add: next_sib descendants split: if_split_asm) apply(intro conjI impI) apply(simp add: valid_list_2_def, erule conjE) apply(erule_tac x=slot in allE)+ apply(fastforce) apply(elim conjE) apply(erule_tac x=slot in allE) apply(erule impE) apply(rule conjI) apply(simp add: descendants_of_def cdt_parent_defs) apply(drule_tac x=q and y=q' in tranclD2, simp) apply(drule rtranclD, simp) apply(rule_tac b=q' in descendants_trans) apply(simp) apply(simp add: child_descendant) apply(simp) apply(simp add: finite_depth) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m)
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> next_not_child slot (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> \<forall>q. slot \<in> descendants_of q n \<longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> next_sib slot (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> next_sib slot (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p = slot\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m)
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_slot slot t m
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot\<rbrakk> \<Longrightarrow> (t slot \<noteq> [] \<longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t) \<and> (t slot = [] \<longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m)
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; \<exists>c. next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []\<rbrakk> \<Longrightarrow> \<exists>c. next_child slot t = Some c
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []\<rbrakk> \<Longrightarrow> \<exists>c. next_child slot t = Some c
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; \<exists>c. next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; t slot = []\<rbrakk> \<Longrightarrow> \<exists>c. next_child slot t = Some c
 2. \<And>a list. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; t slot = a # list\<rbrakk> \<Longrightarrow> \<exists>c. next_child slot t = Some c
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; \<exists>c. next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a list. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; t slot = a # list\<rbrakk> \<Longrightarrow> \<exists>c. next_child slot t = Some c
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; \<exists>c. next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; \<exists>c. next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_child slot t
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot \<noteq> []; next_child slot t = Some c\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> p \<notin> descendants_of slot m
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> p \<notin> descendants_of slot m
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of slot m; \<exists>p. m q = Some p \<and> after_in_list (t p) q = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of slot m; m q = Some pa; after_in_list (t pa) q = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q m
 2. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot\<rbrakk> \<Longrightarrow> slot \<noteq> q
 3. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot\<rbrakk> \<Longrightarrow> slot \<noteq> q
 2. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; after_in_list (t pa) q = Some slot; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot \<in> set (t pa)\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa\<rbrakk> \<Longrightarrow> pa \<in> descendants_of pa m
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa\<rbrakk> \<Longrightarrow> pa \<in> descendants_of pa m
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+ \<or> (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+; slot_p = pa\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (8 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, q) \<in> {(p, c). m c = Some p}
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 4. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 5. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 6. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 8. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; \<exists>z. (q, z) \<in> {(p, c). m c = Some p}\<^sup>* \<and> (z, slot) \<in> {(p, c). m c = Some p}\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (q, pa) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; q = pa \<or> q \<noteq> pa \<and> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (pa, slot) \<in> {(p, c). m c = Some p}
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; \<exists>z. (slot, z) \<in> {(p, c). m c = Some p}\<^sup>* \<and> (z, q) \<in> {(p, c). m c = Some p}\<rbrakk> \<Longrightarrow> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot_p = pa; slot = pa \<or> slot \<noteq> pa \<and> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (slot, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m q = Some pa; slot \<in> descendants_of q m \<or> q \<in> descendants_of slot m; slot_p = pa; pa \<in> descendants_of pa m; valid_mdb s\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> m p \<noteq> Some slot
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m\<rbrakk> \<Longrightarrow> m p \<noteq> Some slot
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c \<and> (\<forall>q'. q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c
 3. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some c
 2. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> m q' \<noteq> Some slot
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> m q' \<noteq> Some slot
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' = Some slot; \<exists>p. m q = Some p \<and> after_in_list (t p) q = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q' pa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot \<in> set (t pa)\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> pa \<in> descendants_of pa m
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> pa \<in> descendants_of pa m
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> (pa, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> (pa, q) \<in> {(p, c). m c = Some p}
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 3. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 4. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 5. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p)\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); \<exists>z. (q, z) \<in> {(p, c). m c = Some p}\<^sup>* \<and> (z, q') \<in> {(p, c). m c = Some p}\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); (q, slot) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); q = slot \<or> q \<noteq> slot \<and> (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); \<exists>z. (q, z) \<in> {(p, c). m c = Some p}\<^sup>* \<and> (z, slot) \<in> {(p, c). m c = Some p}\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); (q, pa) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>c q q' pa. \<lbrakk>m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; (slot, p) \<notin> {(p, c). m c = Some p}\<^sup>+; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; m q = Some pa; slot_p = pa; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p); q = pa \<or> q \<noteq> pa \<and> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, pa) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 3. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>c q q' pa. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some pa; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; m q' = Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; m q = Some pa; slot_p = pa; pa \<in> descendants_of pa m; valid_mdb s\<rbrakk> \<Longrightarrow> False
 2. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>c q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<notin> descendants_of slot m; m p \<noteq> Some slot; q \<noteq> slot; q' \<noteq> slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m; m q' \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot \<noteq> []; next_child slot t = Some c; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> \<forall>q. p \<in> descendants_of q n \<longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)); p \<in> descendants_of q n\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)); q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = Some slot\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; p \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; p \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q m
 2. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> qa \<noteq> q
 3. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; qa \<in> descendants_of q m \<or> q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> qa \<noteq> q
 2. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; qa \<in> descendants_of q m \<or> q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; qa \<in> descendants_of q m \<or> q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; qa \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 2. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; qa \<in> descendants_of q m; (qa \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> next_sib q t m = None
 2. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; q \<noteq> slot; \<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib slot t m = None; p \<in> descendants_of q m; next_sib p t m = None; next_sib qa t m = Some slot; \<forall>q'. q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib q t m \<noteq> Some slot; q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> next_sib q t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; (\<forall>q. slot \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib slot t m = None; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = next_not_child slot t m
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = Some slot; t slot = []; next_not_child slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some slot \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)); next_sib slot t m = Some a \<or> next_sib slot t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> slot \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = Some a\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None))
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = Some a\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = Some a\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q t m \<noteq> Some slot \<and> (next_sib q t m \<noteq> Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q t m \<noteq> Some slot \<and> (next_sib q t m \<noteq> Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (8 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q (?t379 a q) m = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> valid_list_2 (?t379 a q) m
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> no_mloop m
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 7. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 8. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (7 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> valid_list_2 t m
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> no_mloop m
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 6. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 7. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> no_mloop m
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> q \<noteq> slot
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a; q = slot\<rbrakk> \<Longrightarrow> False
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a\<rbrakk> \<Longrightarrow> q \<noteq> slot \<longrightarrow> (\<forall>q'. q' \<noteq> slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a; q \<noteq> slot; q' \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a; q \<noteq> slot; q' \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; p \<in> descendants_of q m; slot \<noteq> a; q \<noteq> slot; q' \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m; (p \<in> descendants_of q' m) = (slot \<in> descendants_of q' m)\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = Some slot; next_sib slot t m = None; next_sib q t m = Some a; slot \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; (p \<in> descendants_of q m) = (slot \<in> descendants_of q m)\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> \<exists>q. (next_sib q t m = Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> p \<in> descendants_of q n \<and> (\<forall>q'. (next_sib q' t m = Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<longrightarrow> p \<notin> descendants_of q' n) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None)))) \<and> (next_sib q t m \<noteq> Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q t m = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. (next_sib q' t m = Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<longrightarrow> p \<notin> descendants_of q' n) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None))))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> (next_sib q t m = Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> p \<in> descendants_of q n \<and> (\<forall>q'. (next_sib q' t m = Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<longrightarrow> p \<notin> descendants_of q' n) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None)))) \<and> (next_sib q t m \<noteq> Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q t m = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. (next_sib q' t m = Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<longrightarrow> p \<notin> descendants_of q' n) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None))))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> (\<forall>q'. next_sib q' t m = Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q m \<longrightarrow> p \<notin> descendants_of q' m))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot\<rbrakk> \<Longrightarrow> False
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; next_sib q' t m = Some slot; q' \<noteq> slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> False
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot; \<exists>p. m slot = Some p \<and> after_in_list (t p) slot = Some a\<rbrakk> \<Longrightarrow> False
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; next_sib q' t m = Some slot; q' \<noteq> slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> False
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; next_sib q' t m = Some slot; q' \<noteq> slot; q' \<in> descendants_of q m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> False
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib slot t m = Some a; next_sib p t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot [], slot := [])) n = None))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q t m \<noteq> Some slot \<and> (next_sib q t m \<noteq> Some slot \<longrightarrow> q \<noteq> slot \<and> (q \<noteq> slot \<longrightarrow> next_sib q t m = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib qa t m \<noteq> Some slot \<and> (next_sib qa t m \<noteq> Some slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> next_sib qa t m = Some a \<and> p \<in> descendants_of qa n \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (6 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib qa (?t500 a q qa) m = Some a
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> valid_list_2 (?t500 a q qa) m
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> no_mloop m
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 5. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 6. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> valid_list_2 t m
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> no_mloop m
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> no_mloop m
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> a \<noteq> slot \<and> (a \<noteq> slot \<longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a\<rbrakk> \<Longrightarrow> valid_list_2 t m
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; (q \<in> descendants_of qa m) = (slot \<in> descendants_of qa m)\<rbrakk> \<Longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; (q \<in> descendants_of qa m) = (slot \<in> descendants_of qa m)\<rbrakk> \<Longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m\<rbrakk> \<Longrightarrow> qa \<noteq> slot \<and> (qa \<noteq> slot \<longrightarrow> p \<in> descendants_of qa m \<and> (\<forall>q'. next_sib q' t m \<noteq> Some slot \<longrightarrow> q' \<noteq> slot \<longrightarrow> q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa = slot\<rbrakk> \<Longrightarrow> False
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of qa m
 3. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of qa m
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q m
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot\<rbrakk> \<Longrightarrow> q \<in> descendants_of qa m
 3. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot\<rbrakk> \<Longrightarrow> q \<in> descendants_of qa m
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q = q'\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'\<rbrakk> \<Longrightarrow> p \<in> descendants_of q' m
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'\<rbrakk> \<Longrightarrow> q \<noteq> q'
 3. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m \<or> q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'\<rbrakk> \<Longrightarrow> q \<noteq> q'
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m \<or> q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m \<or> q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (5 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> valid_list_2 t m
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m; (q \<in> descendants_of q' m) = (slot \<in> descendants_of q' m)\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 4. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (4 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q \<in> descendants_of q' m; (q \<in> descendants_of q' m) = (slot \<in> descendants_of q' m)\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (3 subgoals):
 1. \<And>a q qa q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; slot \<noteq> a; q \<in> descendants_of qa m; qa \<noteq> slot; next_sib q' t m \<noteq> Some slot; q' \<noteq> slot; q' \<in> descendants_of qa m; p \<in> descendants_of q' m; q \<noteq> q'; q' \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (2 subgoals):
 1. \<And>a q qa. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; t slot = []; next_sib p t m = None; next_sib slot t m = None; next_sib q t m = Some slot; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; next_sib qa t m = Some a; slot \<in> descendants_of qa m; \<forall>q'. q' \<in> descendants_of qa m \<and> slot \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = (if p = slot then None else if next_not_child p t m = Some slot then next_slot slot t m else next_not_child p t m) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; (\<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None) \<and> next_sib p t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (4 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> \<forall>q. p \<in> descendants_of q n \<longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (4 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; p \<in> descendants_of q n\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (4 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q = Some slot \<longrightarrow> next_sib slot t m = None) \<and> (t slot \<noteq> [] \<longrightarrow> m q = Some slot \<and> after_in_list (t slot) q = None \<longrightarrow> next_sib slot t m = None)
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot = []; m q = Some slot\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>(\<forall>p. set (t p) = {c. m c = Some p}) \<and> (\<forall>p. distinct (t p)); m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot = []; m q = Some slot\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot = []; m q = Some slot; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p)\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot = []; m q = Some slot; p \<in> descendants_of slot m \<longrightarrow> next_sib slot t m = None; set (t slot) = {c. m c = Some slot}; distinct (t slot)\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (4 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; p \<in> descendants_of q m; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (5 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> q \<in> descendants_of slot m
 2. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None; p \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 5. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (4 subgoals):
 1. \<And>q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None; q \<noteq> slot; t slot \<noteq> []; m q = Some slot \<and> after_in_list (t slot) q = None; p \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 4. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> m p = Some slot \<and> after_in_list (t slot) p = None \<longrightarrow> next_sib slot t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (3 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_sib p t m = None; p \<in> descendants_of slot m \<longrightarrow> next_sib slot t m = None\<rbrakk> \<Longrightarrow> m p = Some slot \<and> after_in_list (t slot) p = None \<longrightarrow> next_sib slot t m = None
 2. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (2 subgoals):
 1. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; \<forall>q. p \<in> descendants_of q m \<longrightarrow> next_sib q t m = None; next_sib p t m = None\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; next_not_child p t m \<noteq> Some slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = next_not_child p t m proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_not_child p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a \<or> next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> finite_depth n
 3. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = Some a; \<exists>pa. m p = Some pa \<and> after_in_list (t pa) p = Some a\<rbrakk> \<Longrightarrow> finite_depth n
 2. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None \<and> (\<exists>q. next_sib q t m = Some a \<and> p \<in> descendants_of q m \<and> (\<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None))\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (1 subgoal):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_not_child p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<and> m p = Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; \<not> (q = slot \<and> m p = Some slot)\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<and> m p = Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; \<not> (q = slot \<and> m p = Some slot)\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p = Some slot\<rbrakk> \<Longrightarrow> after_in_list (t slot) p = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; \<not> (q = slot \<and> m p = Some slot)\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<or> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None \<and> (\<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> next_sib p (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> m p = Some slot \<and> after_in_list (t slot) p = None \<longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot \<and> after_in_list (t slot) p = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None\<rbrakk> \<Longrightarrow> p \<in> descendants_of slot m
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None\<rbrakk> \<Longrightarrow> q \<noteq> slot
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; q \<in> descendants_of slot m \<or> slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None\<rbrakk> \<Longrightarrow> q \<noteq> slot
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; q \<in> descendants_of slot m \<or> slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; q \<in> descendants_of slot m \<or> slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; q \<in> descendants_of slot m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (slot, q) \<in> {(p, c). m c = Some p}\<^sup>+; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+; (slot, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+; (slot, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; \<forall>q'. (q, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; m p = Some slot; after_in_list (t slot) p = None; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+; (slot, slot) \<in> {(p, c). m c = Some p}\<^sup>+; no_mloop m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; m p = Some slot; after_in_list (t slot) p = None; slot \<in> descendants_of q m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot\<rbrakk> \<Longrightarrow> \<exists>c. m c = Some slot \<and> (c, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>z. (slot, z) \<in> {(p, c). m c = Some p} \<and> (z, p) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> \<exists>c. m c = Some slot \<and> (c, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q z. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; (slot, z) \<in> {(p, c). m c = Some p}; (z, p) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> \<exists>c. m c = Some slot \<and> (c, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q z. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; (slot, z) \<in> {(p, c). m c = Some p}; (z, p) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> m z = Some slot \<and> (z, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q z. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m z = Some slot; (z, p) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (z, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q z. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m z = Some slot; z = p \<or> z \<noteq> p \<and> (z, p) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (z, p) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; \<exists>c. m c = Some slot \<and> p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> next_sib c (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> next_sib c (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> next_sib c t m = None
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> next_sib c t m = None
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; c \<in> descendants_of slot m \<and> p \<in> descendants_of c m \<longrightarrow> next_sib c t m = None\<rbrakk> \<Longrightarrow> next_sib c t m = None
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (6 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> c \<in> descendants_of slot m \<and> p \<in> descendants_of c m
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> next_sib c t m = None
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 4. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 6. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> next_sib c t m = None
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot)) \<and> ((\<exists>y. after_in_list (t slot) c = Some y) \<longrightarrow> (next_sib c t m = Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_child slot t = Some a)) \<and> (next_sib c t m \<noteq> Some slot \<longrightarrow> c \<noteq> slot \<and> (c \<noteq> slot \<longrightarrow> next_sib c t m = Some a))))
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> c \<noteq> slot) \<and> (t slot \<noteq> [] \<longrightarrow> (after_in_list (t slot) c = None \<longrightarrow> c \<noteq> slot) \<and> after_in_list (t slot) c = None)
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (6 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot = []\<rbrakk> \<Longrightarrow> c \<noteq> slot
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot \<noteq> []; after_in_list (t slot) c = None\<rbrakk> \<Longrightarrow> c \<noteq> slot
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot \<noteq> []\<rbrakk> \<Longrightarrow> after_in_list (t slot) c = None
 4. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 6. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot \<noteq> []; after_in_list (t slot) c = None\<rbrakk> \<Longrightarrow> c \<noteq> slot
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot \<noteq> []\<rbrakk> \<Longrightarrow> after_in_list (t slot) c = None
 3. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; next_sib c t m = None; t slot \<noteq> []\<rbrakk> \<Longrightarrow> after_in_list (t slot) c = None
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n \<and> (\<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> p \<in> descendants_of c n
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> c \<noteq> slot
 2. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<in> descendants_of c n \<and> p \<in> descendants_of q' n\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> q' \<in> descendants_of slot m
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (6 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> q' \<in> descendants_of c m
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> c \<in> descendants_of slot m
 3. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 4. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 6. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (5 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> c \<in> descendants_of slot m
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 3. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 5. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> next_sib q' t m = None
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot \<and> (m q' \<noteq> Some slot \<longrightarrow> next_sib q' t m \<noteq> Some slot \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None))) \<and> (t slot \<noteq> [] \<longrightarrow> (m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> next_sib q' t m = Some slot) \<and> ((m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y)) \<longrightarrow> (next_sib q' t m = Some slot \<longrightarrow> next_child slot t = None) \<and> (next_sib q' t m \<noteq> Some slot \<longrightarrow> next_sib q' t m = None)))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' \<noteq> Some slot) \<and> (t slot \<noteq> [] \<longrightarrow> m q' = Some slot \<longrightarrow> (\<exists>y. after_in_list (t slot) q' = Some y))
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot = []; m q' = Some slot\<rbrakk> \<Longrightarrow> False
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot = []; m q' = Some slot; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p)\<rbrakk> \<Longrightarrow> False
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot = []; m q' = Some slot; slot \<in> descendants_of slot m \<and> p \<in> descendants_of slot m \<longrightarrow> next_sib slot t m = None; set (t slot) = {c. m c = Some slot}; distinct (t slot)\<rbrakk> \<Longrightarrow> False
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; q' \<in> descendants_of c m \<and> p \<in> descendants_of q' m; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; p \<in> descendants_of slot m; \<forall>q'. q' \<in> descendants_of slot m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; p \<in> descendants_of c m; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; q' \<in> descendants_of c m; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (c, q') \<in> {(p, c). m c = Some p}\<^sup>+; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; \<exists>z. (c, z) \<in> {(p, c). m c = Some p}\<^sup>* \<and> (z, q') \<in> {(p, c). m c = Some p}\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (c, slot) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; c = slot \<or> c \<noteq> slot \<and> (c, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (c, slot) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (slot, c) \<in> {(p, c). m c = Some p}
 2. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (c, c) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (c, c) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q c q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib slot t m = Some a; (slot, p) \<in> {(p, c). m c = Some p}\<^sup>+; \<forall>q'. (slot, q') \<in> {(p, c). m c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). m c = Some p}\<^sup>+ \<longrightarrow> next_sib q' t m = None; m p \<noteq> Some slot; q = slot; m c = Some slot; (c, p) \<in> {(p, c). m c = Some p}\<^sup>+; q' \<noteq> slot; c \<noteq> slot; next_sib q' t m = None; t slot \<noteq> []; m q' = Some slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (c, c) \<in> {(p, c). m c = Some p}\<^sup>+; no_mloop m\<rbrakk> \<Longrightarrow> \<exists>y. after_in_list (t slot) q' = Some y
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<exists>q. next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a \<and> p \<in> descendants_of q n \<and> (\<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> next_sib q (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot\<rbrakk> \<Longrightarrow> m q = Some slot \<and> after_in_list (t slot) q = None \<longrightarrow> next_sib slot t m = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; \<exists>p. m q = Some p \<and> after_in_list (t p) q = Some a\<rbrakk> \<Longrightarrow> m q = Some slot \<and> after_in_list (t slot) q = None \<longrightarrow> next_sib slot t m = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; \<exists>p. m q = Some p \<and> after_in_list (t p) q = Some a; m q = Some slot \<and> after_in_list (t slot) q = None\<rbrakk> \<Longrightarrow> next_sib slot t m = Some a
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q n
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> p \<in> descendants_of q n
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot\<rbrakk> \<Longrightarrow> \<forall>q'. q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n \<longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q = slot \<longrightarrow> m p \<noteq> Some slot; q \<noteq> slot; q' \<in> descendants_of q n \<and> p \<in> descendants_of q' n\<rbrakk> \<Longrightarrow> next_sib q' (t(slot_p := list_replace_list (t slot_p) slot (t slot), slot := [])) n = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> (t slot = [] \<longrightarrow> m q' = Some slot \<longrightarrow> next_sib slot t m = None) \<and> (t slot \<noteq> [] \<longrightarrow> m q' = Some slot \<and> after_in_list (t slot) q' = None \<longrightarrow> next_sib slot t m = None)
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot = []; m q' = Some slot\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot \<noteq> []; m q' = Some slot \<and> after_in_list (t slot) q' = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot = []; m q' = Some slot; \<forall>p. set (t p) = {c. m c = Some p}; \<forall>p. distinct (t p)\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot \<noteq> []; m q' = Some slot \<and> after_in_list (t slot) q' = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot = []; m q' = Some slot; slot \<in> descendants_of q m \<and> p \<in> descendants_of slot m \<longrightarrow> next_sib slot t m = None; set (t slot) = {c. m c = Some slot}; distinct (t slot)\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot \<noteq> []; m q' = Some slot \<and> after_in_list (t slot) q' = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; q' \<in> descendants_of q m \<and> q' \<noteq> slot \<and> p \<in> descendants_of q' m; t slot \<noteq> []; m q' = Some slot \<and> after_in_list (t slot) q' = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; slot \<in> descendants_of q m \<and> p \<in> descendants_of slot m \<longrightarrow> next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> slot \<in> descendants_of q m \<and> p \<in> descendants_of slot m
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> slot \<in> descendants_of q m
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> p \<in> descendants_of slot m
 3. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; q \<noteq> slot; t slot \<noteq> []; (q, q') \<in> {(p, c). m c = Some p}\<^sup>+; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> p \<in> descendants_of slot m
 3. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; (q, p) \<in> {(p, c). m c = Some p}\<^sup>+; q \<noteq> slot; t slot \<noteq> []; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; (q', p) \<in> {(p, c). m c = Some p}\<^sup>+; (q, slot) \<in> {(p, c). m c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (q, slot) \<in> {(p, c). m c = Some p}\<^sup>+
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> p \<in> descendants_of slot m
 3. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> p \<in> descendants_of slot m
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (4 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> p \<in> descendants_of q' m
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> q' \<in> descendants_of slot m
 3. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 4. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (3 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m\<rbrakk> \<Longrightarrow> q' \<in> descendants_of slot m
 2. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 3. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (2 subgoals):
 1. \<And>a q q'. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; q \<noteq> slot; t slot \<noteq> []; q' \<in> descendants_of q m; m q' = Some slot; after_in_list (t slot) q' = None; q' \<noteq> slot; p \<in> descendants_of q' m; next_sib slot t m = None\<rbrakk> \<Longrightarrow> next_sib slot t m = None
 2. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal (1 subgoal):
 1. \<And>a q. \<lbrakk>valid_list_2 t m; m slot = Some slot_p; finite_depth m; p \<noteq> slot; a \<noteq> slot; next_sib p t m = None; next_sib q t m = Some a; p \<in> descendants_of q m; \<forall>q'. q' \<in> descendants_of q m \<and> p \<in> descendants_of q' m \<longrightarrow> next_sib q' t m = None\<rbrakk> \<Longrightarrow> finite_depth n proof (prove)
goal:
No subgoals!