theory Deterministic_AI

lemma desc_next_slot_desc_or_sib:
  notes split_paired_All[simp del] split_paired_Ex[simp del]
  assumes "p \<in> descendants_of slot (cdt s)""valid_list s" "valid_mdb s"
  shows "(\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and>
    q \<in> descendants_of slot (cdt s))
      \<or> last_last_child slot (cdt_list s) = Some p
        \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)" apply(insert assms) apply(case_tac "last_last_child slot (cdt_list s) = Some p") apply(frule(2) last_last_child_empty_desc) apply(frule(2) last_last_child_next_not_child) apply(rule disjI2) apply(simp add: next_slot_def empty_list_empty_desc split: if_split_asm) apply(rule disjI1) apply(case_tac "next_slot p (cdt_list s) (cdt s)") apply(simp) apply(erule notE) apply(rule last_last_childI) apply(simp add: next_slot_def split: if_split_asm) apply(drule next_child_NoneD) apply(simp add: empty_list_empty_desc ) apply(simp add: empty_list_empty_desc) apply(drule next_not_child_NoneD, simp add: finite_depth) apply(erule conjE) apply(induct slot rule: last_child_induct[where s=s]) apply(simp add: last_child_None_empty_desc) apply(case_tac "y=p") apply(fastforce simp: last_child_set_def) apply(simp) apply(atomize) apply(erule impE) apply(simp add: descendants_of_def cdt_parent_defs) apply(frule tranclD, simp) apply(elim exE conjE) apply(drule rtranclD) apply(erule_tac P="z=p" in disjE) apply(simp add: valid_list_2_def) apply(erule conjE) apply(erule_tac x=x in allE)+ apply(simp add: next_sib_def) apply(drule after_in_list_last_None) apply(drule after_in_list_None_last, simp) apply(simp add: last_child_def split: if_split_asm) apply(erule_tac x=z and P="\<lambda>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow>
            next_sib q (cdt_list s) (cdt s) = None" in allE) apply(erule impE) apply(simp) apply(simp add: next_sib_def valid_list_2_def) apply(erule conjE) apply(erule_tac x=x in allE)+ apply(drule after_in_list_last_None) apply(drule after_in_list_None_last, simp) apply(simp add: last_child_def split: if_split_asm) apply(fastforce simp: last_child_set_def intro: trancl_into_trancl) using assms apply(simp_all add: empty_list_empty_desc) apply(simp add: next_slot_def empty_list_empty_desc next_child_def split: if_split_asm list.splits) apply(simp add: next_slot_def split: if_split_asm) apply(fastforce dest: next_childD child_descendant descendants_trans) apply(drule next_not_childD, simp add: finite_depth, simp add: valid_mdb_def) apply(erule disjE) apply(fastforce dest: next_sib_share_parent) apply(rule ccontr) apply(elim exE conjE) apply(erule notE) apply(rule last_last_childI) apply(induct slot rule: last_child_induct[where s=s]) apply(simp add: last_child_None_empty_desc) apply(case_tac "y=p") apply(fastforce simp: last_child_set_def) apply(simp) apply(atomize) apply(erule_tac x=a in allE) apply(erule_tac x=q and P="\<lambda>q. p \<in> descendants_of y (cdt s) \<longrightarrow>
            a \<notin> descendants_of y (cdt s) \<longrightarrow>
            next_sib q (cdt_list s) (cdt s) = Some a \<longrightarrow>
            p \<in> descendants_of q (cdt s) \<longrightarrow>
            (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow>
                  next_sib q' (cdt_list s) (cdt s) = None) \<longrightarrow>
            p \<in> last_child_set y (cdt_list s)" in allE) apply(simp) apply(elim impE) apply(subgoal_tac "x \<in> descendants_of q (cdt s) \<union> {q}") prefer 2 apply(rule ccontr) apply(erule notE) apply(simp) apply(drule_tac c=x in next_sib_share_parent, simp) apply(drule(1) descendants_linear, simp) apply(simp) apply(simp add: descendants_of_def cdt_parent_defs) apply(frule tranclD, simp) apply(elim exE conjE) apply(drule rtranclD) apply(erule_tac P="z=p" in disjE) apply(simp add: valid_list_2_def) apply(erule conjE) apply(erule_tac x=x in allE)+ apply(simp add: next_sib_def) apply(drule after_in_list_last_None) apply(drule after_in_list_None_last, simp) apply(simp add: last_child_def split: if_split_asm) apply(erule_tac x=z in allE) apply(erule impE) apply(rule conjI) apply(fastforce intro: trancl_into_trancl) apply(fastforce dest: rtranclD) apply(simp add: next_sib_def valid_list_2_def) apply(erule conjE) apply(erule_tac x=x in allE)+ apply(drule after_in_list_last_None) apply(drule after_in_list_None_last, simp) apply(simp add: last_child_def split: if_split_asm) apply(rule notI, erule notE) apply(drule(1) last_childD) apply(fastforce dest: child_descendant intro: descendants_trans) apply(fastforce simp: last_child_set_def intro: trancl_into_trancl) using assms apply(simp_all add: empty_list_empty_desc) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) = Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) = Some p; descendants_of p (cdt s) = {}\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) = Some p; descendants_of p (cdt s) = {}; next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) = Some p; descendants_of p (cdt s) = {}; next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)\<rbrakk> \<Longrightarrow> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> (\<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)) \<or> last_last_child slot (cdt_list s) = Some p \<and> next_not_child p (cdt_list s) (cdt s) = next_not_child slot (cdt_list s) (cdt s) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s)
 2. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> False
 2. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> last_last_child slot (cdt_list s) = Some p
 2. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 5. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p \<noteq> []; next_child p (cdt_list s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_not_child p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 6. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p \<noteq> []; cdt_list s p = []\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_not_child p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 6. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_not_child p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 5. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; next_not_child p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 5. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; (\<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None) \<and> next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 5. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 5. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x. \<lbrakk>last_child x (cdt_list s) = None; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 7. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y = p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 7. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of y (cdt s) \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 7. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of y (cdt s) \<longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 7. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; \<exists>z. cdt s z = Some x \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z = p \<or> z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z = p\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (\<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}) \<and> (\<forall>p. distinct (cdt_list s p)); valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s p = Some x; z = p\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s p = Some x; z = p; \<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}; \<forall>p. distinct (cdt_list s p)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s p = Some x; z = p; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib x (cdt_list s) (cdt s) = None; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; after_in_list (cdt_list s x) p = None; y \<noteq> p; cdt s p = Some x; z = p; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; after_in_list (cdt_list s x) p = None; y \<noteq> p; cdt s p = Some x; z = p; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; y \<noteq> p; cdt s p = Some x; z = p; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None; p = last (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q. (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (9 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 9. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (\<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}) \<and> (\<forall>p. distinct (cdt_list s p)); valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; \<forall>x. (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; \<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}; \<forall>p. distinct (cdt_list s p)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (8 subgoals):
 1. \<And>x y z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; y \<noteq> p; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (p, x) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None; z = last (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 8. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (7 subgoals):
 1. \<And>x y. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; descendants_of p (cdt s) = {}; \<forall>q. p \<in> descendants_of q (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = None; next_sib p (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 7. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (6 subgoals):
 1. valid_mdb s
 2. valid_list s
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 6. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
using this:
p \<in> descendants_of slot (cdt s)
valid_list s
valid_mdb s

goal (6 subgoals):
 1. valid_mdb s
 2. valid_list s
 3. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s
 6. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> \<exists>q. next_slot p (cdt_list s) (cdt s) = Some q \<and> q \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>next_slot p (cdt_list s) (cdt s) = None; p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 2. \<And>a. \<lbrakk>last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a; p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>last_last_child slot (cdt_list s) \<noteq> Some p; next_slot p (cdt_list s) (cdt s) = Some a; p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p \<noteq> []; next_child p (cdt_list s) = Some a\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s)
 2. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_not_child p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_not_child p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = Some a \<or> next_sib p (cdt_list s) (cdt s) = None \<and> (\<exists>q. next_sib q (cdt_list s) (cdt s) = Some a \<and> p \<in> descendants_of q (cdt s) \<and> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None))\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (2 subgoals):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = Some a\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s)
 2. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None \<and> (\<exists>q. next_sib q (cdt_list s) (cdt s) = Some a \<and> p \<in> descendants_of q (cdt s) \<and> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None))\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None \<and> (\<exists>q. next_sib q (cdt_list s) (cdt s) = Some a \<and> p \<in> descendants_of q (cdt s) \<and> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None))\<rbrakk> \<Longrightarrow> a \<in> descendants_of slot (cdt s) proof (prove)
goal (1 subgoal):
 1. \<And>a. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None \<and> (\<exists>q. next_sib q (cdt_list s) (cdt s) = Some a \<and> p \<in> descendants_of q (cdt s) \<and> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None)); a \<notin> descendants_of slot (cdt s)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; last_last_child slot (cdt_list s) \<noteq> Some p; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> last_last_child slot (cdt_list s) = Some p proof (prove)
goal (4 subgoals):
 1. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set slot (cdt_list s)
 2. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 3. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (7 subgoals):
 1. \<And>x a q. \<lbrakk>last_child x (cdt_list s) = None; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of y (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of y (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (7 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of y (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y = p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of y (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of y (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<And>a q. \<lbrakk>p \<in> descendants_of y (cdt s); a \<notin> descendants_of y (cdt s); next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; \<forall>a q. p \<in> descendants_of y (cdt s) \<longrightarrow> a \<notin> descendants_of y (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = Some a \<longrightarrow> p \<in> descendants_of q (cdt s) \<longrightarrow> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None) \<longrightarrow> p \<in> last_child_set y (cdt_list s); p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; \<forall>q. p \<in> descendants_of y (cdt s) \<longrightarrow> a \<notin> descendants_of y (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = Some a \<longrightarrow> p \<in> descendants_of q (cdt s) \<longrightarrow> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None) \<longrightarrow> p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> descendants_of y (cdt s) \<longrightarrow> a \<notin> descendants_of y (cdt s) \<longrightarrow> next_sib q (cdt_list s) (cdt s) = Some a \<longrightarrow> p \<in> descendants_of q (cdt s) \<longrightarrow> (\<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None) \<longrightarrow> p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> descendants_of y (cdt s) \<longrightarrow> a \<notin> descendants_of y (cdt s) \<longrightarrow> p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> x \<in> descendants_of q (cdt s) \<union> {q}
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> x \<in> descendants_of q (cdt s) \<union> {q}
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<notin> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> False
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<notin> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<noteq> q \<and> x \<notin> descendants_of q (cdt s)\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<noteq> q \<and> x \<notin> descendants_of q (cdt s); (q \<in> descendants_of x (cdt s)) = (a \<in> descendants_of x (cdt s))\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<noteq> q \<and> x \<notin> descendants_of q (cdt s); (q \<in> descendants_of x (cdt s)) = (a \<in> descendants_of x (cdt s)); x \<in> descendants_of q (cdt s) \<or> q \<in> descendants_of x (cdt s)\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x \<in> descendants_of q (cdt s) \<union> {q}\<rbrakk> \<Longrightarrow> p \<in> descendants_of y (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<exists>z. cdt s z = Some x \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>*\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z = p \<or> z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z = p\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (\<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}) \<and> (\<forall>p. distinct (cdt_list s p)); valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p; \<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}; \<forall>p. distinct (cdt_list s p)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p; (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib x (cdt_list s) (cdt s) = None; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) p = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p; (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) p = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p; (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s p = Some x; z = p; (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> (case cdt s x of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) x) = None; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None; p = last (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; \<forall>q'. (q, q') \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (q', p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (q, z) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<longrightarrow> next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, z) \<in> {(p, c). cdt s c = Some p}\<^sup>+ \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (10 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (q, z) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 5. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 6. valid_mdb s
 7. valid_list s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 10. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (9 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+\<rbrakk> \<Longrightarrow> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 4. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 5. valid_mdb s
 6. valid_list s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 9. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_list s; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; next_sib z (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; (\<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}) \<and> (\<forall>p. distinct (cdt_list s p)); valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; \<forall>p. set (cdt_list s p) = {c. cdt s c = Some p}; \<forall>p. distinct (cdt_list s p)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; set (cdt_list s x) = {c. cdt s c = Some x}; distinct (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; after_in_list (cdt_list s x) z = None; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (8 subgoals):
 1. \<And>x y a q z. \<lbrakk>last_child x (cdt_list s) = Some y; (x, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; valid_mdb s; cdt_list s p = []; (x, a) \<notin> {(p, c). cdt s c = Some p}\<^sup>+; (case cdt s p of None \<Rightarrow> None | Some pa \<Rightarrow> after_in_list (cdt_list s pa) p) = None; (case cdt s q of None \<Rightarrow> None | Some p \<Rightarrow> after_in_list (cdt_list s p) q) = Some a; (q, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; y \<noteq> p; x = q \<or> (q, x) \<in> {(p, c). cdt s c = Some p}\<^sup>+; cdt s z = Some x; z \<noteq> p \<and> (z, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+; set (cdt_list s x) = {c. cdt s c = Some x}; after_in_list (cdt_list s x) (last (cdt_list s x)) = None; z = last (cdt_list s x)\<rbrakk> \<Longrightarrow> (y, p) \<in> {(p, c). cdt s c = Some p}\<^sup>+
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 3. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 4. valid_mdb s
 5. valid_list s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 8. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (7 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p\<rbrakk> \<Longrightarrow> a \<notin> descendants_of y (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (7 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; a \<in> descendants_of y (cdt s)\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (7 subgoals):
 1. \<And>x y a q. \<lbrakk>p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; a \<in> descendants_of y (cdt s); cdt s y = Some x \<and> next_sib y (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> a \<in> descendants_of x (cdt s)
 2. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 3. valid_mdb s
 4. valid_list s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 7. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (6 subgoals):
 1. \<And>x y a q. \<lbrakk>last_child x (cdt_list s) = Some y; p \<in> descendants_of x (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of x (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None; y \<noteq> p; p \<in> last_child_set y (cdt_list s)\<rbrakk> \<Longrightarrow> p \<in> last_child_set x (cdt_list s)
 2. valid_mdb s
 3. valid_list s
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 6. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal (5 subgoals):
 1. valid_mdb s
 2. valid_list s
 3. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
using this:
p \<in> descendants_of slot (cdt s)
valid_list s
valid_mdb s

goal (5 subgoals):
 1. valid_mdb s
 2. valid_list s
 3. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> descendants_of p (cdt s) = {}
 4. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_mdb s
 5. \<And>a q. \<lbrakk>p \<in> descendants_of slot (cdt s); valid_list s; valid_mdb s; cdt_list s p = []; a \<notin> descendants_of slot (cdt s); next_sib p (cdt_list s) (cdt s) = None; next_sib q (cdt_list s) (cdt s) = Some a; p \<in> descendants_of q (cdt s); \<forall>q'. q' \<in> descendants_of q (cdt s) \<and> p \<in> descendants_of q' (cdt s) \<longrightarrow> next_sib q' (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> valid_list s proof (prove)
goal:
No subgoals!