theory CSpace1_R

lemma next_m_n:
  shows "m \<turnstile> p \<leadsto> p' = n \<turnstile> s_d_swp p \<leadsto> s_d_swp p'" using src dest apply (simp add: n_def n'_def modify_map_mdb_cap const_def) apply (simp add: s_d_swap_def) apply (rule conjI, clarsimp) apply (rule conjI, clarsimp) apply (clarsimp simp: mdb_next_unfold modify_map_cases dest2_node_def
                    split: if_split_asm) apply clarsimp apply (rule conjI, clarsimp) apply (clarsimp simp: mdb_next_unfold modify_map_cases) apply (auto simp add: dest2_node_def split: if_split_asm)[1] apply clarsimp apply (simp add: mdb_next_unfold modify_map_cases) apply (simp add: dest2_node_def const_def) apply (intro impI) apply (rule conjI, clarsimp) apply (rule iffI) apply clarsimp apply clarsimp apply clarsimp apply (rule conjI, clarsimp) apply (rule conjI, clarsimp) apply (clarsimp simp: mdb_next_unfold modify_map_cases dest2_node_def) apply (rule conjI) apply clarsimp apply (rule_tac x="CTE dest_cap (mdbNext_update (\<lambda>_. src) src_node)"
                     in exI) apply simp apply (rule_tac x=dest_node in exI) apply clarsimp apply clarsimp apply clarsimp apply (rule conjI, clarsimp) apply (clarsimp simp: mdb_next_unfold modify_map_cases dest2_node_def
                    split: if_split_asm) apply clarsimp apply (clarsimp simp: mdb_next_unfold modify_map_cases dest2_node_def) apply (rule conjI, clarsimp) apply clarsimp apply (rule iffI) apply clarsimp apply (rule_tac x="CTE dest_cap src_node" in exI) apply simp apply (case_tac "mdbPrev src_node = dest") apply clarsimp apply clarsimp apply clarsimp apply clarsimp apply (rule conjI, clarsimp) apply (simp add: mdb_next_unfold modify_map_cases dest2_node_def) apply (rule conjI, clarsimp) apply (case_tac "m p", simp) apply (case_tac a) apply (rename_tac cap node) apply clarsimp apply (frule p_next_eq_src [where p'=p]) apply simp apply (case_tac "mdbNext src_node = 0", simp) apply simp apply (rule allI) apply (rule disjCI2) apply simp apply (erule disjE) apply clarsimp apply (rule disjCI2) apply (clarsimp del: notI) apply (rule notI) apply (erule dlistEn [where p=p]) apply clarsimp apply clarsimp apply clarsimp apply (case_tac "m p", simp) apply (case_tac a) apply (rename_tac cap node) apply clarsimp apply (case_tac "mdbPrev dest_node = p") apply simp apply (frule dest_prev, clarsimp) apply (elim exE conjE) apply simp apply (case_tac "mdbNext src_node = p") apply fastforce apply fastforce apply (subgoal_tac "dest \<noteq> mdbNext node") prefer 2 apply (rule notI) apply (erule dlistEn [where p=p]) apply clarsimp apply clarsimp apply simp apply (rule allI) apply (cases "mdbNext src_node = p") apply simp apply (subgoal_tac "mdbPrev src_node \<noteq> p") prefer 2 apply clarsimp apply simp apply (subgoal_tac "src \<noteq> mdbNext node") apply clarsimp apply (rule notI) apply (erule dlistEn [where p=p]) apply clarsimp apply clarsimp apply simp apply (subgoal_tac "src \<noteq> mdbPrev node") prefer 2 apply (rule notI) apply (erule dlistEp [where p=p]) apply clarsimp apply clarsimp apply (rule disjCI2) apply simp apply (erule disjE) apply clarsimp apply simp apply (rule disjCI) apply simp apply (erule dlistEn [where p=p]) apply clarsimp apply clarsimp apply clarsimp apply (rule conjI, clarsimp) apply (simp add: mdb_next_unfold modify_map_cases dest2_node_def) apply (case_tac "m p", simp) apply (case_tac a) apply (rename_tac cap node) apply simp apply (rule conjI) apply (rule impI) apply simp apply (rule iffI) apply simp apply (rule dlistEn [where p=p], assumption, clarsimp) apply clarsimp apply (elim exE conjE) apply (case_tac "mdbPrev src_node = p") apply simp apply (drule src_prev, clarsimp) apply clarsimp apply clarsimp apply (drule p_next_eq_src [where p'=p]) apply simp apply clarsimp apply (rule iffI) apply simp apply (subgoal_tac "mdbPrev src_node = p") prefer 2 apply (erule dlistEn [where p=p], clarsimp) apply clarsimp apply fastforce apply (elim exE conjE) apply simp apply (case_tac "mdbPrev dest_node = p") apply (frule dest_prev) apply clarsimp apply hypsubst_thin apply clarsimp apply simp apply (case_tac "mdbNext src_node = p") apply simp apply (elim exE conjE) apply (frule src_next, clarsimp) apply simp apply (case_tac "mdbPrev src_node = p") apply clarsimp apply (subgoal_tac "mdbNext (cteMDBNode z) = mdbNext node") prefer 2 apply (case_tac nodea) apply (case_tac z) apply (rename_tac capability mdbnode) apply (case_tac mdbnode) apply clarsimp apply simp apply (rule dlistEn [where p=p], assumption, clarsimp) apply clarsimp apply simp apply (case_tac "mdbPrev src_node = p") apply simp apply (frule src_prev, clarsimp) apply simp apply simp apply (rule dlistEn [where p=p], assumption, clarsimp) apply clarsimp apply clarsimp apply (simp add: mdb_next_unfold modify_map_cases dest2_node_def) apply (rule conjI) apply (rule impI) apply simp apply (case_tac "m p", simp) apply (case_tac a) apply (rename_tac cap node) apply simp apply (case_tac "mdbPrev src_node \<noteq> p") apply simp apply simp apply (frule src_prev, clarsimp) apply simp apply clarsimp apply (case_tac "m p", simp) apply (case_tac a) apply (rename_tac cap node) apply simp apply (case_tac "mdbPrev dest_node = p") apply simp apply (frule dest_prev, clarsimp) apply clarsimp apply simp apply (case_tac "mdbPrev src_node = p") apply simp apply (frule src_prev, clarsimp) apply fastforce apply simp apply (case_tac "mdbNext src_node = p") apply simp apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> p' = n \<turnstile> s_d_swp p \<leadsto> s_d_swp p' proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> p' = n \<turnstile> s_d_swp p \<leadsto> s_d_swp p' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> s_d_swap p src dest \<leadsto> s_d_swap p' src dest proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (p = dest \<longrightarrow> (p' = dest \<longrightarrow> (src, src) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'))) \<and> (p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest\<rbrakk> \<Longrightarrow> (p' = dest \<longrightarrow> (src, src) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' = dest; modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> src\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p')
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p')
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> (p' = src \<longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p')
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' = src\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> dest
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' = src\<rbrakk> \<Longrightarrow> (mdbPrev src_node = dest) = (\<exists>z. (mdbPrev dest2_node \<noteq> src \<longrightarrow> CTE src_cap dest2_node = z) \<and> (mdbPrev dest2_node = src \<longrightarrow> CTE src_cap (mdbNext_update (\<lambda>_. src) dest2_node) = z) \<and> dest = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> m \<turnstile> dest \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> src \<leadsto> p'
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (p' = mdbNext dest_node) = (\<exists>z. (mdbPrev dest2_node \<noteq> src \<longrightarrow> CTE src_cap dest2_node = z) \<and> (mdbPrev dest2_node = src \<longrightarrow> CTE src_cap (mdbNext_update (\<lambda>_. src) dest2_node) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest = mdbPrev src_node \<longrightarrow> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> (p' = mdbNext dest_node) = (p' = 0)) \<and> (p' = mdbNext dest_node) = (p' = mdbPrev src_node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; dest = mdbPrev src_node\<rbrakk> \<Longrightarrow> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> (p' = mdbNext dest_node) = (p' = 0)) \<and> (p' = mdbNext dest_node) = (p' = mdbPrev src_node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; dest = mdbPrev src_node\<rbrakk> \<Longrightarrow> (p' = mdbNext dest_node) = (p' = mdbPrev src_node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; dest = mdbPrev src_node; p' = mdbNext dest_node\<rbrakk> \<Longrightarrow> p' = mdbPrev src_node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; dest = mdbPrev src_node; p' = mdbPrev src_node\<rbrakk> \<Longrightarrow> p' = mdbNext dest_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = dest; p' \<noteq> dest; p' \<noteq> src; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; dest = mdbPrev src_node; p' = mdbPrev src_node\<rbrakk> \<Longrightarrow> p' = mdbNext dest_node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> p \<noteq> dest \<longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> (p = src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))) \<and> (p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p'))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> src
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. (\<exists>cap. (\<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. 0) dest_node = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) src_node) = z) \<and> src = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest = mdbNext src_node \<longrightarrow> (\<exists>z. (\<exists>cap. (\<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. 0) dest_node = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) src_node) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p = src; p' = mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>cap. (\<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. 0) dest_node = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) src_node) = z) \<and> src = mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p = src; p' = mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>cap. (\<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. 0) dest_node = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) src_node) = CTE dest_cap (mdbNext_update (\<lambda>_. src) src_node)) \<and> src = mdbNext (cteMDBNode (CTE dest_cap (mdbNext_update (\<lambda>_. src) src_node)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p = src; p' = mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> \<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. 0) dest_node = node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p = src; p' = mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_node = dest_node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> mdbNext_update (\<lambda>_. 0) dest_node = dest_node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<forall>z. (\<forall>cap node. mdbPrev src_node \<noteq> dest \<and> (dest_cap = cap \<longrightarrow> dest_node \<noteq> node) \<or> mdbPrev src_node = dest \<and> (dest_cap = cap \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node \<noteq> node) \<or> CTE cap src_node \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> (p' = src \<longrightarrow> (dest, dest) \<notin> mdb_next_rel (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p')
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' = src; modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> dest\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> m \<turnstile> src \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> dest \<leadsto> p'
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (p' = mdbNext src_node) = (\<exists>z. (\<exists>cap. (\<exists>node. ((mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0) \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = 0 \<and> mdbNext src_node = 0 \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. 0) dest_node = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) src_node) = z) \<and> p' = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (p' = mdbNext src_node) = (\<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (p' = mdbNext src_node) = (\<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node\<rbrakk> \<Longrightarrow> (p' = mdbNext src_node) = (\<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = CTE dest_cap src_node) \<and> mdbNext src_node = mdbNext (cteMDBNode (CTE dest_cap src_node))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node\<rbrakk> \<Longrightarrow> \<exists>node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node = node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node; mdbPrev src_node = dest\<rbrakk> \<Longrightarrow> \<exists>node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node = node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node = node)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; dest \<noteq> mdbNext src_node; p' = mdbNext src_node; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> mdbNext_update (\<lambda>_. dest) dest_node = node)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p = src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; \<exists>z. (\<exists>cap node. (mdbPrev src_node \<noteq> dest \<longrightarrow> dest_cap = cap \<and> dest_node = node) \<and> (mdbPrev src_node = dest \<longrightarrow> dest_cap = cap \<and> mdbNext_update (\<lambda>_. dest) dest_node = node) \<and> CTE cap src_node = z) \<and> p' = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> p' = mdbNext src_node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest\<rbrakk> \<Longrightarrow> p \<noteq> src \<longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> (p' = dest \<longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src) \<and> (p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p')) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto> dest = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> src
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> mdbNext src_node = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> mdbNext src_node = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some a\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> mdbNext src_node = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>a x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some a; a = CTE x1 x2\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> mdbNext src_node = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some a; a = CTE cap node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> mdbNext src_node = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (mdbNext src_node = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); (mdbNext src_node = mdbNext node) = (src = p \<or> mdbNext src_node = 0 \<and> mdbNext node = 0)\<rbrakk> \<Longrightarrow> (mdbNext src_node = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); (mdbNext src_node = mdbNext node) = (mdbNext src_node = 0 \<and> mdbNext node = 0)\<rbrakk> \<Longrightarrow> (mdbNext src_node = 0 \<and> mdbNext node = 0) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); (mdbNext src_node = mdbNext node) = (mdbNext src_node = 0 \<and> mdbNext node = 0); mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> (mdbNext src_node = 0 \<and> mdbNext node = 0) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>z. mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; \<not> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z)\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node = p \<or> CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; CTE cap node = z; \<not> (mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) \<noteq> z)\<rbrakk> \<Longrightarrow> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src \<noteq> mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; m p = Some (CTE cap node); mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node \<noteq> p; src = mdbNext node\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node \<noteq> p; src = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) \<noteq> 0
 2. \<And>cap node cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node \<noteq> p; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = mdbNext src_node; dest = mdbNext src_node; mdbNext src_node \<noteq> mdbNext node; mdbNext src_node \<noteq> 0; mdbPrev src_node \<noteq> p; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some a\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>a x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some a; a = CTE x1 x2\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some a; a = CTE cap node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> dest = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node)\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = dest\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node = p; m p = Some (CTE capa nodea); mdbNext nodea = dest\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z))
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node capa. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; capa = cap; mdbPrev dest_node = p; m p = Some (CTE cap node); mdbNext node = dest\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node capa. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; capa = cap; mdbPrev dest_node = p; m p = Some (CTE cap node); mdbNext node = dest; mdbNext src_node = p\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z)
 2. \<And>cap node capa. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; capa = cap; mdbPrev dest_node = p; m p = Some (CTE cap node); mdbNext node = dest; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z)
 3. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node capa. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; capa = cap; mdbPrev dest_node = p; m p = Some (CTE cap node); mdbNext node = dest; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> \<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> src = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext node
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest = mdbNext node\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) \<noteq> 0
 2. \<And>cap node cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 3. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> (dest = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> src = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> \<forall>z. mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p\<rbrakk> \<Longrightarrow> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z \<longrightarrow> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p; src \<noteq> mdbNext node\<rbrakk> \<Longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z \<longrightarrow> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src \<noteq> mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src \<noteq> mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p; src = mdbNext node\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p; src = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) \<noteq> 0
 2. \<And>cap node z cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node = p; mdbPrev src_node \<noteq> p; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> p \<and> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z) \<or> mdbNext src_node = p \<and> (\<forall>capa nodea. mdbPrev src_node \<noteq> p \<and> (cap = capa \<longrightarrow> node \<noteq> nodea) \<or> mdbPrev src_node = p \<and> (cap = capa \<longrightarrow> mdbNext_update (\<lambda>_. dest) node \<noteq> nodea) \<or> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) \<noteq> z) \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src \<noteq> mdbPrev node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src \<noteq> mdbPrev node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src = mdbPrev node\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src = mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (CTE cap node)) \<noteq> 0
 2. \<And>cap node z cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src = mdbPrev node; m (mdbPrev (cteMDBNode (CTE cap node))) = Some cte'; mdbNext (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src = mdbPrev node; m (mdbPrev (cteMDBNode (CTE cap node))) = Some cte'; mdbNext (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> False
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z \<or> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; \<not> (mdbPrev src_node \<noteq> p \<and> CTE cap node \<noteq> z)\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; mdbPrev src_node = p \<or> CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some z; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; CTE cap node = z\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z \<or> src \<noteq> mdbNext (cteMDBNode z)
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = dest; dest \<noteq> mdbNext src_node; m p = Some z; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; src \<noteq> mdbPrev node; CTE cap node = z; \<not> src \<noteq> mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m (mdbNext (cteMDBNode z)) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext (cteMDBNode z); p' = dest; dest \<noteq> mdbNext src_node; m p = Some z; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; mdbNext (cteMDBNode z) \<noteq> mdbPrev node; CTE cap node = z; src = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m (mdbNext (cteMDBNode z)) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext (cteMDBNode z); p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; mdbNext (cteMDBNode z) \<noteq> mdbPrev node; CTE cap node = z; src = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) \<noteq> 0
 2. \<And>cap node z cte'. \<lbrakk>m (mdbNext (cteMDBNode z)) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext (cteMDBNode z); p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; mdbNext (cteMDBNode z) \<noteq> mdbPrev node; CTE cap node = z; src = mdbNext (cteMDBNode z); m (mdbNext (cteMDBNode z)) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<And>cap node z cte'. \<lbrakk>m (mdbNext (cteMDBNode z)) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext (cteMDBNode z); p' = dest; dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p; dest \<noteq> mdbNext node; mdbNext src_node \<noteq> p; mdbNext (cteMDBNode z) \<noteq> mdbPrev node; CTE cap node = z; src = mdbNext (cteMDBNode z); m (mdbNext (cteMDBNode z)) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> mdbPrev src_node = p \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) \<noteq> z
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src\<rbrakk> \<Longrightarrow> p' \<noteq> dest \<longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> (p' = src \<longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest) \<and> (p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p') proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto> src = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> dest
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> dest = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some a\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> dest = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>a x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some a; a = CTE x1 x2\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> dest = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some a; a = CTE cap node\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> src = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> dest = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. p) node = nodeb) \<and> mdbPrev_update (\<lambda>_. p) nodeb = nodea) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest = mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. p) node = nodeb) \<and> mdbPrev_update (\<lambda>_. p) nodeb = nodea) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. p) node = nodeb) \<and> mdbPrev_update (\<lambda>_. p) nodeb = nodea) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> mdbNext src_node = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node cte'. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; \<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> mdbNext src_node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext (cteMDBNode z); CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext (cteMDBNode z); CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = src\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>a cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node; dest = mdbNext src_node; mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z; mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z; mdbNext src_node = mdbNext (cteMDBNode z); mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext node; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext node; mdbNext src_node = mdbNext node; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext node; p \<noteq> src; p' = src; dest = mdbNext node; mdbNext src_node = mdbNext node; mdbPrev src_node \<noteq> p; (mdbNext src_node = mdbNext node) = (src = p \<or> mdbNext src_node = 0 \<and> mdbNext node = 0)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node\<rbrakk> \<Longrightarrow> (src = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. mdbNext node) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. mdbNext node) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> mdbPrev src_node = p
 3. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node\<rbrakk> \<Longrightarrow> mdbPrev src_node = p
 2. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. mdbNext node) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 3. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node cte'. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; dest \<noteq> mdbNext src_node; src = mdbNext node; m (mdbNext (cteMDBNode (CTE cap node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> mdbPrev src_node = p
 2. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. mdbNext node) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 3. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> mdbNext node; p' = mdbNext node; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; src = mdbNext node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. mdbNext node) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)
 2. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; \<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' = src; m p = Some (CTE cap node); dest \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> p \<noteq> 0
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = dest\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = dest\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); mdbPrev dest_node \<noteq> mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> src; m (mdbPrev dest_node) = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> mdbPrev dest_node \<longrightarrow> (mdbNext src_node \<noteq> mdbPrev dest_node \<longrightarrow> (mdbPrev src_node \<noteq> mdbPrev dest_node \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = mdbPrev dest_node \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = mdbPrev dest_node \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> mdbPrev dest_node \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = mdbPrev dest_node \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = mdbPrev dest_node \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> mdbPrev dest_node \<longrightarrow> (mdbPrev src_node \<noteq> mdbPrev dest_node \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = mdbPrev dest_node \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = mdbPrev dest_node \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> mdbPrev dest_node \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = mdbPrev dest_node \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); \<exists>cap node. m (mdbPrev dest_node) = Some (CTE cap node) \<and> mdbNext node = mdbNext (cteMDBNode z)\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodeb) \<and> mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); \<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbPrev node = src\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea x1 x2 x3 x4. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; nodea = MDB x1 x2 x3 x4\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea x1 x2 x3 x4 x1a x2a. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; nodea = MDB x1 x2 x3 x4; z = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea x1 x2 x3 x4 capability mdbnode. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; nodea = MDB x1 x2 x3 x4; z = CTE capability mdbnode\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (4 subgoals):
 1. \<And>cap node z capa nodea x1 x2 x3 x4 capability mdbnode x1a x2a x3a x4a. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; nodea = MDB x1 x2 x3 x4; z = CTE capability mdbnode; mdbnode = MDB x1a x2a x3a x4a\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode z) = mdbNext node
 2. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 4. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa nodea. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node = p; mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea; mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea; CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext node; p \<noteq> src; p' = src; m p = Some (CTE capa node); dest = mdbNext node; mdbPrev dest_node \<noteq> p; mdbNext src_node = p; cap = capa; CTE capa (mdbPrev_update (\<lambda>_. mdbNext node) node) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z capa cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext node; p \<noteq> src; p' = src; m p = Some (CTE capa node); dest = mdbNext node; mdbPrev dest_node \<noteq> p; mdbNext src_node = p; cap = capa; CTE capa (mdbPrev_update (\<lambda>_. mdbNext node) node) = z; mdbPrev node = src; mdbPrev src_node \<noteq> p; mdbNext (cteMDBNode z) = mdbNext node; m (mdbNext (cteMDBNode (CTE capa node))) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. mdbNext (cteMDBNode z)) nodea) = z)); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z; dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (3 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z; dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = src\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some (CTE cap node); mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode z)) node) = z); dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some z; mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; CTE cap node = z; dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (2 subgoals):
 1. \<And>cap node z cte'. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext (cteMDBNode z)) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext (cteMDBNode z); p \<noteq> src; p' = src; m p = Some z; mdbNext (cteMDBNode z) \<noteq> mdbNext src_node; CTE cap node = z; dest = mdbNext (cteMDBNode z); mdbPrev dest_node \<noteq> p; mdbNext src_node \<noteq> p; mdbPrev src_node \<noteq> p; m (mdbNext (cteMDBNode z)) = Some cte'; mdbPrev (cteMDBNode cte') = p\<rbrakk> \<Longrightarrow> src = mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest\<rbrakk> \<Longrightarrow> p' \<noteq> src \<longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> m \<turnstile> p \<leadsto> p' = modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> p \<leadsto> p' proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> (dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z))) \<and> (dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest = mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. p) node = nodea)) \<and> mdbPrev_update (\<lambda>_. p) nodea = node) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some a\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some a; a = CTE x1 x2\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some a; a = CTE cap node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (3 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; \<not> mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> p' = mdbNext (cteMDBNode z))
 3. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; \<not> mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. mdbNext src_node) node) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> p' \<noteq> mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); p \<noteq> mdbNext src_node; p \<noteq> src; p' \<noteq> mdbNext src_node; p' \<noteq> src; dest = mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev src_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = src\<rbrakk> \<Longrightarrow> p' \<noteq> mdbNext node
 2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node \<longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some a\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a x1 x2. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some a; a = CTE x1 x2\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some a; a = CTE cap node\<rbrakk> \<Longrightarrow> (\<exists>z. m p = Some z \<and> p' = mdbNext (cteMDBNode z)) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some z) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>cap node. m p = Some (CTE cap node) \<and> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>cap node. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>cap node. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap node)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>nodea. m p = Some (CTE cap nodea) \<and> mdbNext_update (\<lambda>_. dest) nodea = node))) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> m p = Some (CTE cap nodea)) \<and> (mdbPrev src_node = p \<longrightarrow> (\<exists>node. m p = Some (CTE cap node) \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> mdbPrev_update (\<lambda>_. dest) nodea = node)) \<and> CTE cap (mdbNext_update (\<lambda>_. src) node) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node = p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = dest\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbPrev dest_node \<noteq> p \<longrightarrow> (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z))) \<and> (mdbPrev dest_node = p \<longrightarrow> (\<exists>capa nodea. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>nodeb. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodeb) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodeb) \<and> mdbPrev_update (\<lambda>_. dest) nodeb = nodea)) \<and> CTE capa (mdbNext_update (\<lambda>_. src) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node = p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) (mdbNext_update (\<lambda>_. dest) node)) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node = p; \<exists>cap node. m p = Some (CTE cap node) \<and> mdbNext node = src\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) (mdbNext_update (\<lambda>_. dest) node)) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> (mdbPrev src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbPrev src_node = p \<longrightarrow> CTE cap (mdbNext_update (\<lambda>_. dest) node) = z)) \<and> (mdbNext src_node = p \<longrightarrow> (\<exists>capa nodea. (mdbPrev src_node \<noteq> p \<longrightarrow> cap = capa \<and> node = nodea) \<and> (mdbPrev src_node = p \<longrightarrow> cap = capa \<and> mdbNext_update (\<lambda>_. dest) node = nodea) \<and> CTE capa (mdbPrev_update (\<lambda>_. dest) nodea) = z)) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (2 subgoals):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p; mdbNext src_node = p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z) \<and> p' = mdbNext (cteMDBNode z))
 2. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal (1 subgoal):
 1. \<And>a cap node. \<lbrakk>m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node); p \<noteq> dest; p \<noteq> src; p' \<noteq> dest; p' \<noteq> src; dest \<noteq> mdbNext src_node; m p = Some (CTE cap node); a = CTE cap node; mdbPrev dest_node \<noteq> p; mdbPrev src_node \<noteq> p; mdbNext src_node \<noteq> p\<rbrakk> \<Longrightarrow> (p' = mdbNext node) = (\<exists>z. (mdbNext src_node \<noteq> p \<longrightarrow> CTE cap node = z) \<and> (mdbNext src_node = p \<longrightarrow> CTE cap (mdbPrev_update (\<lambda>_. dest) node) = z) \<and> p' = mdbNext (cteMDBNode z)) proof (prove)
goal:
No subgoals!