theory CSpace_R

lemma chunked_n:
  assumes b: "badge_derived' c' src_cap"
  shows "mdb_chunked n" using chunked_m src b apply (clarsimp simp: mdb_chunked_def) apply (drule n_cap)+ apply clarsimp apply (simp split: if_split_asm) apply clarsimp apply (erule_tac x=src in allE) apply (erule_tac x=p' in allE) apply simp apply (case_tac "src=p'") apply (clarsimp simp: n_trancl_eq) apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply (drule (1) trancl_rtrancl_trancl) apply simp apply (clarsimp simp: n_trancl_eq) apply (rule conjI) apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply (clarsimp split: if_split_asm) apply clarsimp apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply (rule conjI) apply clarsimp apply (erule_tac x=src in allE) apply simp apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply (clarsimp split: if_split_asm) apply (clarsimp simp: n_trancl_eq) apply (case_tac "p=src") apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply (drule (1) trancl_rtrancl_trancl) apply simp apply simp apply (erule_tac x=p in allE) apply (erule_tac x=src in allE) apply clarsimp apply (rule conjI) apply clarsimp apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply clarsimp apply (clarsimp simp: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply (clarsimp simp: n_trancl_eq) apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply clarsimp apply (rule conjI) apply clarsimp apply (simp add: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply clarsimp apply (rule conjI) apply clarsimp apply (rule conjI) apply clarsimp apply (erule sameRegionAsE, simp_all add: sameRegionAs_def3)[1] apply blast apply blast apply (clarsimp simp: isCap_simps) apply fastforce apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp apply clarsimp apply (simp add: is_chunk_def n_trancl_eq n_rtrancl_eq n_dest new_dest_def) apply clarsimp apply (rule conjI) apply clarsimp apply (rule conjI) apply clarsimp apply (erule_tac x=p in allE, simp, erule(1) sameRegionAs_trans) apply fastforce apply clarsimp apply (erule_tac x=p'' in allE) apply clarsimp apply (drule_tac p=p'' in m_cap) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. mdb_chunked n proof (prove)
using this:
mdb_chunked m
m src = Some (CTE src_cap src_node)
badge_derived' c' src_cap

goal (1 subgoal):
 1. mdb_chunked n proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap na cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; n p = Some (CTE cap na); n p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap na cap' n'. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; \<exists>node'. if p = dest then cap = c' \<and> m p = Some (CTE dest_cap node') else m p = Some (CTE cap node'); \<exists>node'. if p' = dest then cap' = c' \<and> m p' = Some (CTE dest_cap node') else m p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; if p = dest then cap = c' \<and> m dest = Some (CTE dest_cap node') else m p = Some (CTE cap node'); if p' = dest then cap' = c' \<and> m dest = Some (CTE dest_cap node'a) else m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); \<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; p = dest; m dest = Some (CTE dest_cap node')\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); \<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node')\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); \<forall>p' cap. (\<exists>n. m src = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src))\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); \<forall>cap. (\<exists>n. m src = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src))\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src)\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src = p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>node'. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap src_cap; m dest = Some (CTE dest_cap node')\<rbrakk> \<Longrightarrow> is_chunk n src_cap src dest
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>node' p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap src_cap; m dest = Some (CTE dest_cap node'); p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>node' p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap src_cap; m dest = Some (CTE dest_cap node'); p'' \<noteq> dest; m \<turnstile> p'' \<leadsto>\<^sup>* src; m \<turnstile> src \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p' \<longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src); src \<noteq> p'\<rbrakk> \<Longrightarrow> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> (m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest)
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n c' dest p'
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a p'' cap'' n''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs src_cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a p'' cap'' n''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs src_cap cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap' p' dest
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m src_cap src p'; m \<turnstile> p' \<leadsto>\<^sup>+ src; is_chunk m cap' p' src\<rbrakk> \<Longrightarrow> is_chunk n cap' p' dest
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> (p'' = dest \<longrightarrow> global.sameRegionAs cap' src_cap) \<and> (p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' = dest \<longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node' node'a. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> m \<turnstile> src \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m src = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')
 3. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p'' cap'' n''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p' cap' node' node'a p'' cap'' n''. \<lbrakk>m p' = Some (CTE cap' node'a); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; dest \<noteq> p'; m dest = Some (CTE dest_cap node'); src \<noteq> p'; m \<turnstile> src \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; global.sameRegionAs cap' cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''
 2. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); p' = dest; m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<or> n \<turnstile> dest \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ dest \<longrightarrow> is_chunk n cap p dest) \<and> (n \<turnstile> dest \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p = src\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>node'a p''. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap src_cap; m dest = Some (CTE dest_cap node'a); p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>node'a p''. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')))); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs src_cap src_cap; m dest = Some (CTE dest_cap node'a); p'' \<noteq> dest; m \<turnstile> p'' \<leadsto>\<^sup>* src; m \<turnstile> src \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src\<rbrakk> \<Longrightarrow> (p = src \<or> m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (p = src \<longrightarrow> is_chunk n cap src dest) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; \<forall>p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; \<forall>cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m src = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> src \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' src p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest) \<and> (m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p)
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk n cap p dest
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p; m \<turnstile> p \<leadsto>\<^sup>+ src; is_chunk m cap p src\<rbrakk> \<Longrightarrow> is_chunk n cap p dest
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p \<leadsto>\<^sup>+ src; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (3 subgoals):
 1. \<And>p cap node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')); m \<turnstile> p \<leadsto>\<^sup>+ src; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* src; global.sameRegionAs cap cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<or> m \<turnstile> src \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n c' dest p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> is_chunk m cap p src; m \<turnstile> src \<leadsto>\<^sup>+ p; is_chunk m src_cap src p\<rbrakk> \<Longrightarrow> is_chunk n c' dest p
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs src_cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p cap node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m dest = Some (CTE dest_cap node'a); p \<noteq> src; m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> src \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs src_cap cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<or> n \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (n \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (n \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>\<forall>p p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p)); m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); \<forall>p' cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); \<forall>cap. (\<exists>n. m p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. m p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p') \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk n cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p; m \<turnstile> p \<leadsto>\<^sup>+ p'; is_chunk m cap p p'\<rbrakk> \<Longrightarrow> is_chunk n cap p p'
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<forall>p''. (p'' = dest \<longrightarrow> (p = src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap)) \<and> (p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> (p'' = dest \<longrightarrow> (p = src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap)) \<and> (p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''))
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' = dest \<longrightarrow> (p = src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap)
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap) \<and> (m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap)
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (4 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; global.sameRegionAs src_cap cap'; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap src_cap
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (6 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap cap' = capMasterCap cap'' \<and> cap' \<noteq> capability.NullCap \<and> \<not> isZombie cap' \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap' \<and> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<or> isIRQControlCap src_cap \<and> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; capRange cap' \<noteq> {}; capRange cap' \<subseteq> capRange src_cap; isUntypedCap src_cap\<rbrakk> \<Longrightarrow> capRange src_cap = {} \<longrightarrow> isIRQControlCap src_cap \<and> isIRQHandlerCap src_cap
 2. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<and> (isUntypedCap src_cap \<or> isArchPageCap cap'') \<or> isIRQControlCap src_cap \<and> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; capRange cap' \<noteq> {}; capRange cap' \<subseteq> capRange src_cap; isArchPageCap src_cap; isArchPageCap cap'\<rbrakk> \<Longrightarrow> capRange src_cap = {} \<longrightarrow> isIRQControlCap src_cap \<and> isIRQHandlerCap src_cap
 3. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap cap' = capMasterCap cap'' \<and> cap' \<noteq> capability.NullCap \<and> \<not> isZombie cap' \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap' \<and> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap src_cap = capMasterCap cap'' \<and> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap \<and> isArchPageCap cap'') \<or> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; isIRQControlCap src_cap; isIRQHandlerCap cap'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<or> capRange src_cap \<noteq> {} \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap) \<or> isIRQHandlerCap src_cap
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 5. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 6. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (5 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<and> (isUntypedCap src_cap \<or> isArchPageCap cap'') \<or> isIRQControlCap src_cap \<and> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; capRange cap' \<noteq> {}; capRange cap' \<subseteq> capRange src_cap; isArchPageCap src_cap; isArchPageCap cap'\<rbrakk> \<Longrightarrow> capRange src_cap = {} \<longrightarrow> isIRQControlCap src_cap \<and> isIRQHandlerCap src_cap
 2. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap cap' = capMasterCap cap'' \<and> cap' \<noteq> capability.NullCap \<and> \<not> isZombie cap' \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap' \<and> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap src_cap = capMasterCap cap'' \<and> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap \<and> isArchPageCap cap'') \<or> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; isIRQControlCap src_cap; isIRQHandlerCap cap'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<or> capRange src_cap \<noteq> {} \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap) \<or> isIRQHandlerCap src_cap
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 4. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 5. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (4 subgoals):
 1. \<And>p' cap' node'a. \<lbrakk>badge_derived' c' src_cap; m src = Some (CTE src_cap src_node); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap cap' = capMasterCap cap'' \<and> cap' \<noteq> capability.NullCap \<and> \<not> isZombie cap' \<and> \<not> isUntypedCap cap' \<and> \<not> isArchPageCap cap' \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange cap' \<and> (isUntypedCap cap' \<or> isArchPageCap cap' \<and> isArchPageCap cap'') \<or> isIRQControlCap cap' \<and> isIRQHandlerCap cap''))); m \<turnstile> src \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> (capMasterCap src_cap = capMasterCap cap'' \<and> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<and> cap'' \<noteq> capability.NullCap \<and> \<not> isZombie cap'' \<and> \<not> isUntypedCap cap'' \<and> \<not> isArchPageCap cap'' \<or> capRange cap'' \<noteq> {} \<and> capRange cap'' \<subseteq> capRange src_cap \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap \<and> isArchPageCap cap'') \<or> isIRQHandlerCap cap'')); p' \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p'; isIRQControlCap src_cap; isIRQHandlerCap cap'\<rbrakk> \<Longrightarrow> src_cap \<noteq> capability.NullCap \<and> \<not> isZombie src_cap \<and> \<not> isUntypedCap src_cap \<and> \<not> isArchPageCap src_cap \<or> capRange src_cap \<noteq> {} \<and> (isUntypedCap src_cap \<or> isArchPageCap src_cap) \<or> isIRQHandlerCap src_cap
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 4. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> p' \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs cap src_cap
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 3. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; \<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''); p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')); m \<turnstile> p \<leadsto>\<^sup>+ p'; p'' \<noteq> dest; m \<turnstile> p \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p'; global.sameRegionAs cap cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap''
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<or> m \<turnstile> p' \<leadsto>\<^sup>+ p; m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk n cap' p' p proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk m cap p p'; m \<turnstile> p' \<leadsto>\<^sup>+ p; is_chunk m cap' p' p\<rbrakk> \<Longrightarrow> is_chunk n cap' p' p proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<forall>p''. (p'' = dest \<longrightarrow> (p' = src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap)) \<and> (p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> (p'' = dest \<longrightarrow> (p' = src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap)) \<and> (p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' = dest \<longrightarrow> (p' = src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap)
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> (p' = src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap) \<and> (m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap)
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (3 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p' = src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (3 subgoals):
 1. \<And>p cap node'. \<lbrakk>badge_derived' c' src_cap; global.sameRegionAs cap src_cap; p \<noteq> dest; m p = Some (CTE cap node'); m src = Some (CTE src_cap src_node); m \<turnstile> p \<leadsto>\<^sup>+ src \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* src \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> src \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> src \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs src_cap cap''); p \<noteq> src; m \<turnstile> src \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> global.sameRegionAs src_cap src_cap
 2. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap
 3. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (2 subgoals):
 1. \<And>p p' cap cap' node' node'a. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ src \<longrightarrow> p \<noteq> src \<and> m \<turnstile> src \<leadsto>\<^sup>* p \<longrightarrow> global.sameRegionAs cap' src_cap
 2. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> p'' \<noteq> dest \<longrightarrow> m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'') proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; \<forall>p''. m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''); p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; m \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; m p'' = Some (CTE cap'' n'')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal (1 subgoal):
 1. \<And>p p' cap cap' node' node'a p'' cap'' n''. \<lbrakk>m src = Some (CTE src_cap src_node); badge_derived' c' src_cap; global.sameRegionAs cap cap'; p \<noteq> p'; p \<noteq> dest; m p = Some (CTE cap node'); p' \<noteq> dest; m p' = Some (CTE cap' node'a); m \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. m \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> m \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. m p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap cap'')); m \<turnstile> p' \<leadsto>\<^sup>+ p; p'' \<noteq> dest; m \<turnstile> p' \<leadsto>\<^sup>+ p''; m \<turnstile> p'' \<leadsto>\<^sup>* p; global.sameRegionAs cap' cap''; \<exists>node'. if p'' = dest then cap'' = dest_cap \<and> n p'' = Some (CTE c' node') else n p'' = Some (CTE cap'' node')\<rbrakk> \<Longrightarrow> \<exists>cap''. (\<exists>n''. n p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap'' proof (prove)
goal:
No subgoals!