theory CSpace_R

lemma untyped_inc_n:
  "\<lbrakk>capAligned src_cap;isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}\<rbrakk>
   \<Longrightarrow> untyped_inc' n" using untyped_inc apply (clarsimp simp add: untyped_inc'_def descendants split del: if_split) apply (drule n_cap)+ apply (clarsimp split: if_split_asm) apply (case_tac "p=dest", simp) apply (simp add: descendants_of'_def untyped_c') apply (erule_tac x=p in allE) apply (erule_tac x=src in allE) apply (simp add: src) apply (frule_tac p=p in untyped_no_parent) apply clarsimp apply (erule disjE) apply clarsimp apply (case_tac "p = src") using src apply clarsimp apply (drule(4) parent_untyped_must_not_usable) apply simp apply (intro conjI) apply clarsimp apply clarsimp using src apply clarsimp apply clarsimp apply (case_tac "p=dest") apply (simp add: descendants_of'_def untyped_c') apply (erule_tac x=p' in allE) apply (erule_tac x=src in allE) apply (clarsimp simp:src) apply (frule_tac p=p' in untyped_no_parent) apply (case_tac "p' = src") apply (clarsimp simp:src) apply (elim disjE) apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply simp+ apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply simp+ apply (clarsimp simp:Int_ac) apply (erule_tac x=p' in allE) apply (erule_tac x=p in allE) apply (case_tac "p' = src") apply (clarsimp simp:src descendants_of'_def untyped_c') apply (elim disjE) apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply (simp,intro conjI,clarsimp+) apply (intro conjI) apply clarsimp+ apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply (simp,intro conjI,clarsimp+) apply (intro conjI) apply clarsimp+ apply (clarsimp simp:Int_ac,intro conjI,clarsimp+) apply (clarsimp simp:descendants_of'_def) apply (case_tac "p = src") apply simp apply (elim disjE) apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply (simp,intro conjI,clarsimp+) apply (intro conjI) apply clarsimp+ apply (erule disjE[OF iffD1[OF subset_iff_psubset_eq]]) apply clarsimp+ apply fastforce apply (clarsimp simp:Int_ac,intro conjI,clarsimp+) apply (intro conjI) apply (elim disjE) apply (simp add:Int_ac)+ apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}\<rbrakk> \<Longrightarrow> untyped_inc' n proof (prove)
using this:
untyped_inc' m

goal (1 subgoal):
 1. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}\<rbrakk> \<Longrightarrow> untyped_inc' n proof (prove)
goal (1 subgoal):
 1. \<And>p p' c na c' n'. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); n p = Some (CTE c na); isUntypedCap c; n p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> (if src \<in> descendants_of' p' m \<or> p' = src then insert dest (descendants_of' p' m) else descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> (if src \<in> descendants_of' p m \<or> p = src then insert dest (descendants_of' p m) else descendants_of' p m) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> (if src \<in> descendants_of' p m \<or> p = src then insert dest (descendants_of' p m) else descendants_of' p m) \<and> usableUntypedRange c = {} \<or> p \<in> (if src \<in> descendants_of' p' m \<or> p' = src then insert dest (descendants_of' p' m) else descendants_of' p' m) \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c'a n'. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; \<exists>node'. if p = dest then c = c' \<and> m p = Some (CTE dest_cap node') else m p = Some (CTE c node'); \<exists>node'. if p' = dest then c'a = c' \<and> m p' = Some (CTE dest_cap node') else m p' = Some (CTE c'a node')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> (if src \<in> descendants_of' p' m \<or> p' = src then insert dest (descendants_of' p' m) else descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> (if src \<in> descendants_of' p m \<or> p = src then insert dest (descendants_of' p m) else descendants_of' p m) \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> (if src \<in> descendants_of' p m \<or> p = src then insert dest (descendants_of' p m) else descendants_of' p m) \<and> usableUntypedRange c = {} \<or> p \<in> (if src \<in> descendants_of' p' m \<or> p' = src then insert dest (descendants_of' p' m) else descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p = dest \<longrightarrow> c = c' \<and> node'a = node'; p = dest \<or> m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> (p = dest \<or> p \<in> descendants_of' dest m) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' dest m) \<and> usableUntypedRange c' = {} \<or> p = dest)) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' dest m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' dest m \<and> usableUntypedRange c' = {} \<or> p = dest))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> (p = dest \<or> p \<in> descendants_of' dest m) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' dest m) \<and> usableUntypedRange c' = {} \<or> p = dest)) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' dest m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' dest m \<and> usableUntypedRange c' = {} \<or> p = dest)))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p = dest \<longrightarrow> c = c' \<and> node'a = node'; p = dest \<or> m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> (p = dest \<or> p \<in> descendants_of' dest m) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' dest m) \<and> usableUntypedRange c' = {} \<or> p = dest)) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' dest m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> p \<in> descendants_of' dest m \<and> usableUntypedRange c' = {} \<or> p = dest))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> (p = dest \<or> p \<in> descendants_of' dest m) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' dest m) \<and> usableUntypedRange c' = {} \<or> p = dest)) \<and> (src \<notin> descendants_of' dest m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' dest m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> dest \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> dest \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' dest m \<and> usableUntypedRange c' = {} \<or> p = dest)))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m src = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = src))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (p = src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p) \<and> (untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src); \<not> m \<turnstile> src \<rightarrow> p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (p = src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; untypedRange c = untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 3. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (4 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 3. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange c = untypedRange src_cap; usableUntypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> usableUntypedRange c = {}) \<and> (m \<turnstile> p \<rightarrow> src \<or> p = src)
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap)
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}
 3. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> p = src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {}
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m src = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> usableUntypedRange c = {}
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (3 subgoals):
 1. \<And>c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m src = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> usableUntypedRange c = {}
 2. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); m dest = Some (CTE dest_cap node'a); p \<noteq> dest; \<not> m \<turnstile> src \<rightarrow> p; \<not> untypedRange c \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> p = src; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange src_cap
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p = dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p')))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); p = dest\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); p = dest; \<forall>p'a c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p'a = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p'a \<rightarrow> p' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p'a \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p'a \<and> usableUntypedRange c = {} \<or> m \<turnstile> p'a \<rightarrow> p' \<and> usableUntypedRange c' = {} \<or> p' = p'a))\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); p = dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m src = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c' = {} \<or> p' = src))\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> untypedRange src_cap \<inter> usableUntypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange src_cap = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange src_cap = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange src_cap = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange src_cap = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange src_cap = {}; untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange src_cap \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 3. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<subset> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' = untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 3. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange src_cap \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 4. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); \<not> untypedRange c' \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {}; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange src_cap \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> untypedRange src_cap \<noteq> untypedRange c'
 2. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); \<not> untypedRange c' \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {}; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange src_cap \<subset> untypedRange c'\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> untypedRange src_cap \<noteq> untypedRange c'
 2. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); \<not> untypedRange c' \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {}; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange src_cap = untypedRange c'\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> untypedRange src_cap \<noteq> untypedRange c'
 3. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); untypedRange c' \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p'; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<or> p' = src; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (p' = src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> (untypedRange src_cap = untypedRange c' \<longrightarrow> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<and> p' \<noteq> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange src_cap \<and> untypedRange src_cap \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p' c' node' node'a. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap src_cap; isUntypedCap c'; p' \<noteq> dest; m dest = Some (CTE dest_cap node'); m p' = Some (CTE c' node'a); \<not> untypedRange c' \<subset> untypedRange src_cap; untypedRange src_cap \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange src_cap \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {}; \<not> m \<turnstile> src \<rightarrow> p'; p' \<noteq> src; untypedRange c' \<inter> untypedRange src_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' = untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange src_cap \<subseteq> untypedRange c' \<or> untypedRange c' = untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c' = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c' \<and> untypedRange src_cap \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>p'a c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p'a = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p'a m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p'a \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p'a \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p'a m \<and> usableUntypedRange c' = {} \<or> p' = p'a))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p))\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' = src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p')))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<inter> untypedRange c = {}; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 5. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> m \<turnstile> src \<rightarrow> p)
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap = untypedRange c\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> m \<turnstile> src \<rightarrow> p
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 5. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subseteq> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c \<subset> untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src) \<and> (p = src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> m \<turnstile> src \<rightarrow> p)
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 3. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> src \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src
 2. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange c = untypedRange src_cap\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> m \<turnstile> src \<rightarrow> p
 3. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 4. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>capAligned src_cap; usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap src_cap; m p = Some (CTE c node'); p \<noteq> dest; untypedRange src_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> src \<and> untypedRange src_cap \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p; untypedRange src_cap = untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p \<or> m \<turnstile> p \<rightarrow> src \<and> usableUntypedRange c = {} \<or> src = p; untypedRange src_cap \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> src \<rightarrow> p \<or> p = src)) \<and> (p = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange c \<subset> untypedRange src_cap \<and> \<not> untypedRange src_cap \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange src_cap \<or> untypedRange src_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange src_cap = {}) \<and> \<not> untypedRange src_cap \<subset> untypedRange c \<and> (untypedRange c = untypedRange src_cap \<longrightarrow> m \<turnstile> src \<rightarrow> p))
 2. \<And>p p' c c'a node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'a; p' \<noteq> dest; p = dest \<longrightarrow> c = c' \<and> m dest = Some (CTE dest_cap node'); p = dest \<or> m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); p \<noteq> dest; \<forall>c. (\<exists>n. m p' = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c' = {} \<or> p' = p)); p' \<noteq> src\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {} \<or> p = src)) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> src = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> src \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> src = p'))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' p' m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> (p = dest \<or> p \<in> descendants_of' p' m) \<and> usableUntypedRange c'a = {} \<or> p = p')) \<and> (p' = src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> (p = dest \<or> p \<in> descendants_of' src m) \<and> usableUntypedRange c'a = {})) \<and> (src \<notin> descendants_of' p' m \<and> p' \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c'a = {} \<or> p = p'))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p' = p\<rbrakk> \<Longrightarrow> (src \<in> descendants_of' p m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (src \<in> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (src \<notin> descendants_of' p' m \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' src m) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' src m \<and> usableUntypedRange c = {}))) \<and> (src \<notin> descendants_of' p m \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 5. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (4 subgoals):
 1. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c' = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {})
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (5 subgoals):
 1. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c' = untypedRange c\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}
 2. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c' = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 5. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (3 subgoals):
 1. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (4 subgoals):
 1. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c = untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (3 subgoals):
 1. \<And>p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; untypedRange c = untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {}) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {})
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m src = Some (CTE c node'); m p' = Some (CTE c' node'a); p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> src \<and> usableUntypedRange c' = {} \<or> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}; p = src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) \<and> (p = src \<longrightarrow> (m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c' = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> src \<rightarrow> p') \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> src \<rightarrow> p' \<and> usableUntypedRange c = {}))) \<and> (\<not> m \<turnstile> p \<rightarrow> src \<and> p \<noteq> src \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p' proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src; untypedRange c' \<subseteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}
 2. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src; untypedRange c \<subseteq> untypedRange c'\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}
 3. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src; untypedRange c' \<inter> untypedRange c = {}\<rbrakk> \<Longrightarrow> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}
 4. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p' proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c' node' node'a. \<lbrakk>capAligned src_cap; isUntypedCap src_cap \<longrightarrow> usableUntypedRange src_cap = {}; isUntypedCap c; isUntypedCap c'; p' \<noteq> dest; m p = Some (CTE c node'); m p' = Some (CTE c' node'a); p \<noteq> dest; p' \<noteq> src; untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c \<inter> untypedRange c' = {}; untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}; untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}; untypedRange c' = untypedRange c \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> p' = p; p \<noteq> src\<rbrakk> \<Longrightarrow> untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p' proof (prove)
goal:
No subgoals!