theory Untyped_R

lemma untyped_inc_n' [simp]: "untypedRange c' \<inter> usableUntypedRange parent_cap = {} \<Longrightarrow> untyped_inc' n'" using untyped_inc apply (clarsimp simp: untyped_inc'_def) apply (drule n'_cap)+ apply (clarsimp simp: descendants_of'_def parency_n' split: if_split_asm) apply (frule untypedRange_c') apply (insert parent is_untyped)[1] apply (erule_tac x=parent in allE) apply (erule_tac x=p' in allE) apply clarsimp apply (case_tac "untypedRange parent_cap = untypedRange c'a") apply simp apply (intro conjI) apply (intro impI) apply (elim disjE conjE) apply (drule(1) subtree_trans,simp) apply (simp add:subset_not_psubset) apply simp apply (clarsimp simp:subset_not_psubset) apply (drule valid_capI')+ apply (drule(2) disjoint_subset[OF usableRange_subseteq[OF valid_capAligned],rotated -1]) apply simp apply (clarsimp) apply (rule int_not_empty_subsetD) apply (drule(1) rangeD) apply (simp add:untypedCapRange Int_ac) apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']]) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply simp apply (erule subset_splitE) apply (simp|elim conjE)+ apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply blast apply (simp|elim conjE)+ apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (intro conjI,intro impI,drule(1) subtree_trans,simp) apply clarsimp apply (intro impI) apply (drule(1) rangeD) apply (simp add:untypedCapRange Int_ac) apply (rule int_not_empty_subsetD) apply (simp add:Int_ac) apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']]) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply simp apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (drule(1) disjoint_subset[rotated]) apply simp apply (drule_tac B = "untypedRange c'a" in int_not_empty_subsetD) apply (erule aligned_untypedRange_non_empty[OF capAligned_c']) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply simp apply (frule untypedRange_c') apply (insert parent is_untyped)[1] apply (erule_tac x=p in allE) apply (erule_tac x=parent in allE) apply clarsimp apply (case_tac "untypedRange parent_cap = untypedRange c") apply simp apply (intro conjI) apply (intro impI) apply (elim disjE conjE) apply (clarsimp simp:subset_not_psubset )+ apply (drule(1) subtree_trans,simp) apply simp apply (clarsimp simp:subset_not_psubset) apply (drule disjoint_subset[OF usableRange_subseteq[OF valid_capAligned[OF valid_capI']],rotated]) apply simp apply assumption apply simp apply clarsimp apply (rule int_not_empty_subsetD) apply (drule(1) rangeD) apply (simp add:untypedCapRange Int_ac) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply (erule aligned_untypedRange_non_empty[OF capAligned_c']) apply simp apply (erule subset_splitE) apply (simp|elim conjE)+ apply (thin_tac "P \<longrightarrow> Q" for P Q)+ apply (intro conjI,intro impI,drule(1) subtree_trans,simp) apply clarsimp apply (intro impI) apply (drule(1) rangeD) apply (simp add:untypedCapRange Int_ac) apply (rule int_not_empty_subsetD) apply (simp add:Int_ac) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply (erule aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_c']]) apply simp apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply blast apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply simp apply (drule(1) disjoint_subset2[rotated]) apply simp apply (drule_tac B = "untypedRange c'" in int_not_empty_subsetD) apply (erule(1) aligned_untypedRange_non_empty[OF valid_capAligned[OF valid_capI']]) apply (erule aligned_untypedRange_non_empty[OF capAligned_c']) apply simp apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply simp apply blast done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. untypedRange c' \<inter> usableUntypedRange parent_cap = {} \<Longrightarrow> untyped_inc' n' proof (prove)
using this:
untyped_inc' m

goal (1 subgoal):
 1. untypedRange c' \<inter> usableUntypedRange parent_cap = {} \<Longrightarrow> untyped_inc' n' proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c'a n'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); n' p = Some (CTE c n); isUntypedCap c; n' p' = Some (CTE c'a n'a); isUntypedCap c'a\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' n' \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p n' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p n' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' n' \<and> usableUntypedRange c'a = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c n c'a n'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' m \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p m \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p m \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' m \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; if p = site then c = c' \<and> m p = Some (CTE capability.NullCap site_node) else \<exists>node'. m p = Some (CTE c node'); if p' = site then c'a = c' \<and> m p' = Some (CTE capability.NullCap site_node) else \<exists>node'. m p' = Some (CTE c'a node')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> p \<in> descendants_of' p' n' \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p n' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> p' \<in> descendants_of' p n' \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' n' \<and> usableUntypedRange c'a = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node')\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; \<forall>p' c. (\<exists>n. m parent = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c' = {} \<or> parent = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; \<forall>c. (\<exists>n. m parent = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c' = {} \<or> parent = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (8 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<rightarrow> parent; usableUntypedRange c'a = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; parent = p'\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 5. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 6. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 7. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 8. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (7 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; m \<turnstile> p' \<rightarrow> parent; usableUntypedRange c'a = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; parent = p'\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 5. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 6. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 7. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; parent = p'\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>untypedRange parent_cap \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap parent_cap; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange c' = untypedRange parent_cap\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>untypedRange parent_cap \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap parent_cap; untypedRange c' = untypedRange parent_cap; valid_cap' capability.NullCap s; valid_cap' parent_cap s\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>isUntypedCap c'; isUntypedCap parent_cap; untypedRange c' = untypedRange parent_cap; valid_cap' capability.NullCap s; valid_cap' parent_cap s; usableUntypedRange parent_cap \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<inter> untypedRange c'a = {}
 2. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; usableUntypedRange parent_cap = {}; capRange c'a \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<inter> untypedRange c'a = {}
 2. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange c'a; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c'a; \<not> m \<turnstile> p' \<rightarrow> parent; p' \<noteq> parent; m \<turnstile> parent \<rightarrow> p'; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange parent_cap = {} \<or> m \<turnstile> p' \<rightarrow> parent \<and> usableUntypedRange c'a = {} \<or> parent = p'; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<inter> untypedRange c'a = {}; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<subset> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<subset> untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; untypedRange parent_cap \<inter> usableUntypedRange c'a = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {}) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {}))
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<subset> untypedRange c'a; m \<turnstile> p' \<rightarrow> parent; untypedRange parent_cap \<inter> usableUntypedRange c'a = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {}) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {}))
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p'; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent\<rbrakk> \<Longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; capRange c'a \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (7 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<inter> untypedRange c'a = {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 6. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 7. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c'a \<subset> untypedRange parent_cap; untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent; untypedRange c'a \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap = untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c'a = {}; untypedRange c'a \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange parent_cap \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c' \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c' \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c' \<or> untypedRange c' \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; untypedRange c' \<inter> untypedRange c'a = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 3. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> untypedRange c'a \<noteq> {}
 2. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p' c'a node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; isUntypedCap c'a; m site = Some (CTE capability.NullCap site_node); p' \<noteq> site; m p' = Some (CTE c'a node'); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c'a; \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a\<rbrakk> \<Longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c' \<subset> untypedRange c'a \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> (untypedRange c' = untypedRange c'a \<longrightarrow> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c' \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c' \<and> untypedRange c' \<noteq> untypedRange c'a)
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m parent = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = parent))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (7 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; m \<turnstile> p \<rightarrow> parent; usableUntypedRange c = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; p = parent\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 6. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 7. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; p = parent\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; m \<turnstile> p \<rightarrow> parent; p = parent\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap parent_cap; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'\<rbrakk> \<Longrightarrow> untypedRange parent_cap \<inter> ?B685 = {}
 2. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'\<rbrakk> \<Longrightarrow> m ?p685 = Some (CTE parent_cap ?node685)
 3. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'; usableUntypedRange parent_cap \<inter> ?B685 = {}\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'\<rbrakk> \<Longrightarrow> m ?p685 = Some (CTE parent_cap ?node685)
 2. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'; usableUntypedRange parent_cap \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c'; m site = Some (CTE capability.NullCap site_node); m parent = Some (CTE parent_cap parent_node); untypedRange parent_cap = untypedRange c'; usableUntypedRange parent_cap \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> usableUntypedRange parent_cap = {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap = untypedRange c\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c \<inter> untypedRange c' = {}
 2. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 3. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; usableUntypedRange parent_cap = {}; capRange c \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c \<inter> untypedRange c' = {}
 2. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 3. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 2. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange c; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap = untypedRange c; \<not> m \<turnstile> p \<rightarrow> parent; p \<noteq> parent; m \<turnstile> parent \<rightarrow> p; usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange c = untypedRange parent_cap \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange parent_cap = {} \<or> p = parent; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subseteq> untypedRange parent_cap \<or> untypedRange parent_cap \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange parent_cap = {}; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; m \<turnstile> parent \<rightarrow> p; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; capRange c \<inter> capRange c' = {}\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (7 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c \<inter> untypedRange c' = {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 7. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (6 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 6. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (5 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<subset> untypedRange parent_cap; untypedRange c \<inter> usableUntypedRange parent_cap = {}; \<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 5. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}))
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange parent_cap \<subset> untypedRange c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {}))
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c = untypedRange parent_cap\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange parent_cap = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; untypedRange c \<inter> untypedRange c' = {}\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (4 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange c \<noteq> {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 3. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 4. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (3 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c\<rbrakk> \<Longrightarrow> untypedRange c' \<noteq> {}
 2. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 3. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (2 subgoals):
 1. \<And>p c node'. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'; p \<noteq> site; m p = Some (CTE c node'); m site = Some (CTE capability.NullCap site_node); untypedRange c' \<subseteq> untypedRange parent_cap; m parent = Some (CTE parent_cap parent_node); isUntypedCap parent_cap; untypedRange c \<subset> untypedRange parent_cap \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange parent_cap = {}; untypedRange parent_cap \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> parent \<and> untypedRange parent_cap \<inter> usableUntypedRange c = {}; untypedRange parent_cap \<noteq> untypedRange c; \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c'\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (p = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> usableUntypedRange c = {})) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c' \<and> \<not> untypedRange c' \<subset> untypedRange c \<and> untypedRange c \<noteq> untypedRange c')
 2. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; \<forall>p p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p')); isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a)\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); \<forall>p' c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); \<forall>c. (\<exists>n. m p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. m p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c' = {} \<or> p = p'))\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {})) \<and> (p' = parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> untypedRange c'a \<inter> usableUntypedRange c = {}))) proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'a node' node'a. \<lbrakk>untypedRange c' \<inter> usableUntypedRange parent_cap = {}; isUntypedCap c; isUntypedCap c'a; p \<noteq> site; p' \<noteq> site; m p = Some (CTE c node'); m p' = Some (CTE c'a node'a); (untypedRange c \<subseteq> untypedRange c'a \<or> untypedRange c'a \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c'a = {}) \<and> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> p' \<rightarrow> p \<and> untypedRange c \<inter> usableUntypedRange c'a = {}) \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> untypedRange c'a \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> p \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> m \<turnstile> p' \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = p')\<rbrakk> \<Longrightarrow> (m \<turnstile> p \<rightarrow> parent \<longrightarrow> p' = parent \<longrightarrow> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p) \<and> (untypedRange c = untypedRange c'a \<longrightarrow> usableUntypedRange c = {} \<or> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {} \<or> p = parent)) \<and> (p = parent \<longrightarrow> (m \<turnstile> p' \<rightarrow> parent \<longrightarrow> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p') \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> usableUntypedRange c'a = {} \<or> parent = p')) \<and> (p' = parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c'a \<and> \<not> untypedRange c'a \<subset> untypedRange c) \<and> (\<not> m \<turnstile> p' \<rightarrow> parent \<and> p' \<noteq> parent \<longrightarrow> \<not> untypedRange c \<subset> untypedRange c'a \<and> (untypedRange c'a \<subset> untypedRange c \<longrightarrow> m \<turnstile> parent \<rightarrow> p') \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p' \<and> usableUntypedRange c = {} \<or> parent = p'))) \<and> (\<not> m \<turnstile> p \<rightarrow> parent \<and> p \<noteq> parent \<longrightarrow> p' = parent \<longrightarrow> (untypedRange c \<subset> untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p) \<and> \<not> untypedRange c'a \<subset> untypedRange c \<and> (untypedRange c = untypedRange c'a \<longrightarrow> m \<turnstile> parent \<rightarrow> p \<and> usableUntypedRange c'a = {})) proof (prove)
goal:
No subgoals!