theory CNodeInv_R

lemma (in mdb_swap) cteSwap_chain:
  "mdb_chain_0 n" proof - have chain: "mdb_chain_0 m" using valid .. let ?m = "(modify_map
    (modify_map
         (modify_map
           (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))))
             (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (%_. dest))))
           src (cteMDBNode_update (\<lambda>m. dest2_node)))
         dest (cteMDBNode_update (\<lambda>m. src_node)))
       (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (%_. src))))" let ?n' = "modify_map m src (cteMDBNode_update (mdbNext_update (%_. (mdbNext dest_node))))" have [simp]: "src \<in> dom m" by (rule domI, rule src) have [simp]: "dest \<in> dom m" by (rule domI, rule dest) have dn: "m \<turnstile> dest \<leadsto> mdbNext dest_node" using dest by (rule next_fold, simp) have dp: "mdbPrev dest_node \<in> dom m
    \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest" proof - assume "mdbPrev dest_node \<in> dom m" hence "mdbPrev dest_node \<noteq> 0" using no_0 by - (rule, clarsimp) thus ?thesis using dest apply - apply (clarsimp dest!: dest_prev [where p = "mdbPrev dest_node", simplified]) apply (erule next_fold) apply simp done qed have [simp]: "\<not> m \<turnstile> dest \<leadsto>\<^sup>+ dest" using mdb_chain_0_no_loops [OF chain no_0] by (simp add: no_loops_trancl_simp) have [simp]: "\<not> m \<turnstile> src \<leadsto>\<^sup>+ src" using mdb_chain_0_no_loops [OF chain no_0] by (simp add: no_loops_trancl_simp) have [simp]: "\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* src" by (rule neg_next_rtrancl_nx, rule src, simp) have sn: "mdbPrev src_node \<in> dom m
    \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src" proof - assume "mdbPrev src_node \<in> dom m" hence "mdbPrev src_node \<noteq> 0" using no_0 by - (rule, clarsimp) thus ?thesis using src apply - apply (clarsimp dest!: src_prev [where p = "mdbPrev src_node", simplified]) apply (erule next_fold) apply simp done qed from chain no_0 neq [symmetric] have "mdb_chain_0 ?m" proof (cases rule: mdb_chain_0_cases) case srcdest note [simp] = neg_rtrancl_into_trancl [OF srcdest(2)] note [simp] = srcdest(2) have dsneq: "dest \<noteq> mdbPrev src_node" proof assume "dest = mdbPrev src_node" hence "m \<turnstile> dest \<leadsto>\<^sup>* src" by - (rule r_into_rtrancl, rule next_fold [where m = m, OF dest], simp) thus False using srcdest by simp qed from dest have n1 [simp]:"\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* src" by (rule neg_next_rtrancl_nx [OF _ neg_rtrancl_into_trancl]) fact+ have chain_n': "mdb_chain_0 ?n'" proof (cases "mdbNext dest_node \<in> dom m") case True thus ?thesis using n1 by (rule mdb_chain_0_modify_map_next [OF chain no_0]) next case False thus ?thesis using dest chain no_0 by - (drule (3) ndom_is_0D, simp, erule (1) mdb_chain_0_modify_map_0) qed from dest src have n4: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node" using neg_next_rtrancl_np [OF _ _ _ no_0 dlist neg_rtrancl_into_trancl] by auto hence n2 [simp]: "\<not> ?n' \<turnstile> src \<leadsto>\<^sup>* dest" using dn src by (auto dest: rtrancl_into_trancl2 simp: modify_map_lhs_rtrancl) hence n3: "mdbPrev src_node \<in> dom m
      \<Longrightarrow> \<not> modify_map ?n' dest (cteMDBNode_update (mdbNext_update (%_. src))) \<turnstile> dest \<leadsto>\<^sup>* mdbPrev src_node" using dest dsneq src n1 by (simp add: modify_map_lhs_rtrancl modify_map_app) (rule n4) from srcdest(1) show ?thesis proof (cases rule: tranclE2') case base hence ds: "dest = mdbNext src_node" by (clarsimp simp: next_unfold' src) hence d2: "dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)" using dsneq unfolding dest2_node_def by clarsimp let ?m' = "(modify_map
          (modify_map ?n' dest (cteMDBNode_update (mdbNext_update (%_. src))))
           (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))))" let ?goal = "mdb_chain_0 ?m'" { assume d1: "mdbPrev src_node \<in> dom m" and d2: "mdbNext dest_node \<in> dom m" hence ?goal apply (intro mdb_chain_0_modify_map_next) apply (auto simp: no_0 chain n1 n2 n3[OF d1]) done } moreover { assume d1: "mdbPrev src_node \<notin> dom m" and "mdbNext dest_node \<in> dom m" hence ?goal by simp ((rule mdb_chain_0_modify_map_next)+, simp_all add: no_0 chain n1 n2) } moreover { assume d1: "mdbPrev src_node \<in> dom m" and "mdbNext dest_node \<notin> dom m" hence m0: "mdbNext dest_node = 0" by (clarsimp dest!: dest_next [where p = "mdbNext dest_node", simplified]) have ?goal using chain_n' d1 src dest apply - apply (rule  mdb_chain_0_modify_map_next) apply (rule  mdb_chain_0_modify_map_next [OF chain_n']) apply (simp_all add: no_0 chain n1 n2  n3 [OF d1]) done } moreover { assume d1: "mdbPrev src_node \<notin> dom m" and "mdbNext dest_node \<notin> dom m" hence m0: "mdbNext dest_node = 0" by (clarsimp dest!: dest_next [where p = "mdbNext dest_node", simplified]) have ?goal using d1 chain_n' apply simp apply (rule mdb_chain_0_modify_map_next) apply (simp_all add: no_0 chain n1 n2) done } ultimately have ?goal apply (cases "mdbPrev src_node \<in> dom m") apply (cases "mdbNext dest_node \<in> dom m") apply (auto)[2] apply (cases "mdbNext dest_node \<in> dom m") apply auto done thus ?thesis using ds [symmetric] d2 neqs dsneq apply simp apply (subst modify_map_addr_com [OF neqs(2)]) apply (subst modify_map_comp [symmetric]) apply (subst modify_map_comp [symmetric]) apply (simp) apply (simp add: o_def) apply (rule mdb_chain_0_modify_map_replace) apply simp apply (subst modify_map_addr_com [where x = src]) apply simp apply (rule mdb_chain_0_modify_map_replace) apply simp apply (subst modify_map_addr_com [OF dsneq [symmetric]]) apply (subst modify_map_addr_com [where y = src], simp)+ apply assumption done next case (trancl c) hence dsneq': "dest \<noteq> mdbNext src_node" using src apply - apply rule apply simp apply (drule next_fold) apply simp apply (drule (1) next_single_value) apply simp done hence d2n: "dest2_node = dest_node" unfolding dest2_node_def by (cases dest_node, simp add: dsneq) from trancl obtain d where dnext: "m \<turnstile> d \<leadsto> dest" and ncd: "m \<turnstile> c \<leadsto>\<^sup>* d" by (clarsimp dest!: tranclD2) have ddest: "d = mdbPrev (cteMDBNode (CTE dest_cap dest_node))" using dest dlist no_0 dnext by (rule next_prev) hence d2: "mdbPrev dest_node \<in> dom m" using dnext by (clarsimp simp: next_unfold') have dnz: "mdbPrev dest_node \<noteq> 0" by (rule dom_into_not0 [OF no_0 d2]) have n5 [simp]: "\<not> ?n' \<turnstile> src \<leadsto>\<^sup>* mdbPrev dest_node" proof - have "src \<noteq> mdbPrev dest_node" by (simp add: dsneq' [symmetric]) hence "?n' \<turnstile> mdbPrev dest_node \<leadsto> dest" using dp [OF d2] by (clarsimp simp: next_unfold' modify_map_other) thus ?thesis using n2 by - (erule contrapos_nn, erule (1) rtrancl_into_rtrancl) qed let ?n2 = "modify_map ?n' (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src)))" have chain_n2: "mdb_chain_0 ?n2" by ((rule chain_n' | rule mdb_chain_0_modify_map_next)+, simp_all add: no_0) have r [simp]: "\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev dest_node" by (rule neg_next_rtrancl_np [OF _ _ d2 no_0 dlist], rule dest, rule dest, simp) have r3 [simp]: "\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* src" by (rule neg_next_rtrancl_nx, rule dest, simp) have r4 [simp]: "\<not> m \<turnstile> dest \<leadsto>\<^sup>+ mdbPrev dest_node" by (rule neg_next_trancl_xp [OF _ d2 no_0 dlist], rule dest, simp) let ?m'' =
        "(modify_map (modify_map
          (modify_map ?n' (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src))))
           (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))))
          dest (cteMDBNode_update (mdbNext_update (%_. (mdbNext src_node)))))" have n2_2 [simp]:
        "?n2 \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node" apply (cases "mdbNext src_node = mdbPrev dest_node") apply simp apply (rule trancl_into_rtrancl) apply (rule next_modify_map_trancl_last [OF chain_n'], simp add: no_0) apply (subst modify_map_trancl_other_iff) apply simp apply (rule next_trancl_np [OF _ _ dlist no_0]) apply (rule src, rule dest) apply (simp add: dsneq' [symmetric]) apply assumption apply (rule srcdest(1)) done hence n2_3 [simp]: "\<not> ?n2 \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ dest" proof (rule neg_next_trancl_trancl) show "\<not> ?n2 \<turnstile> dest \<leadsto>\<^sup>* mdbPrev dest_node" apply (rule neg_rtranclI) apply simp apply (subst next_modify_map_trancl_last_iff [OF chain_n' chain_n2]) apply (simp add: no_0) apply (simp add: modify_map_trancl_other_iff) done show "\<not> ?n2 \<turnstile> mdbPrev dest_node \<leadsto>\<^sup>* dest" using d2 by (clarsimp simp: modify_map_lhs_rtrancl modify_map_other dsneq' [symmetric]) qed have r5 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> dest \<leadsto>\<^sup>+ mdbPrev src_node" by (rule neg_next_trancl_xp [OF _ _ no_0 dlist], rule src, simp_all) have n2_4 [simp]:
        "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> ?n2 \<turnstile> dest \<leadsto>\<^sup>* mdbPrev src_node" apply - apply (rule neg_rtranclI [OF dsneq]) apply (subst modify_map_trancl_other_iff) apply (rule neg_rtranclI) apply (simp_all add: modify_map_trancl_other_iff) done let ?goal = "mdb_chain_0 ?m''" { assume d1: "mdbPrev src_node \<in> dom m" and d3: "mdbNext src_node \<in> dom m" have r2 [simp]: "\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node" using dest src by (rule neg_next_rtrancl_np [OF _ _ _ no_0 dlist neg_rtrancl_into_trancl]) fact+ have ?goal proof ((rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1 d1) have n2_1:
            "\<not> ?n2 \<turnstile> mdbPrev dest_node \<leadsto>\<^sup>* mdbPrev src_node" using d2  dsneq' [symmetric] apply - apply (erule domE) apply (subst modify_map_lhs_rtrancl) apply (clarsimp simp: modify_map_other) apply simp apply simp apply (simp add: dom_into_not0 [OF no_0 d2]) apply (subst modify_map_lhs_rtrancl, rule src) apply simp apply (simp) done have "\<not> ?n' \<turnstile> mdbPrev src_node \<leadsto>\<^sup>+ mdbPrev dest_node" apply (rule neg_next_rtrancl_trancl [where y = src]) apply (subst modify_map_lhs_rtrancl) apply (rule src) apply simp apply (simp add: dsneq' [symmetric]) apply (subst next_modify_map_last) apply simp apply (rule sn [OF d1]) done hence "mdbPrev src_node \<noteq> 0 \<Longrightarrow> \<not> ?n2 \<turnstile> mdbPrev src_node \<leadsto>\<^sup>* mdbPrev dest_node" apply - apply (rule neg_rtranclI) apply simp apply (subst next_modify_map_trancl_last_iff [OF chain_n' chain_n2]) apply (simp add: no_0) apply assumption done moreover from no_0 have "mdbPrev src_node \<noteq> 0" using d1 by auto ultimately show
            "\<not> modify_map ?n2 (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" using n2_1 apply - apply (rule neg_rtranclI) apply (simp add: dsneq' [symmetric]) apply (subst modify_map_trancl_other_iff) apply (rule neg_rtranclI) apply simp apply (rule neg_next_trancl_trancl [OF n2_2]) apply auto done qed fact+ } moreover { assume d1: "mdbPrev src_node \<notin> dom m" and d3: "mdbNext src_node \<in> dom m" have ?goal proof (simp add: d1, (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1) show "\<not> ?n2 \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" by (rule neg_rtranclI [OF _ n2_3], simp add: dsneq' [symmetric]) qed fact+ } moreover { assume d1: "mdbPrev src_node \<in> dom m" and d3: "mdbNext src_node \<notin> dom m" hence m0: "mdbNext src_node = 0" by (clarsimp dest!: src_next [where p = "mdbNext src_node", simplified]) have ?goal by (simp add: m0,
          (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_0 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1 d1) } moreover { assume d1: "mdbPrev src_node \<notin> dom m" and d3: "mdbNext src_node \<notin> dom m" hence m0: "mdbNext src_node = 0" by (clarsimp dest!: src_next [where p = "mdbNext src_node", simplified]) have ?goal by (simp add: m0 d1,
          (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_0 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1 d1) } ultimately have ?goal apply (cases "mdbPrev src_node \<in> dom m") apply (cases "mdbNext src_node \<in> dom m") apply (auto)[2] apply (cases "mdbNext src_node \<in> dom m") apply auto done thus ?thesis using no_0 d2n apply simp apply (subst modify_map_addr_com [where y = "mdbPrev dest_node"]) apply simp apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_addr_com [where x = src]) apply (simp add: dsneq' [symmetric]) apply (subst modify_map_addr_com [where x = src]) apply simp apply (rule mdb_chain_0_modify_map_replace) apply simp apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_addr_com [where y = dest], simp add: dsneq [symmetric] dsneq')+ apply (subst modify_map_addr_com [where y = "mdbPrev src_node"], simp add: dsneq) apply (subst modify_map_addr_com [where y = "mdbPrev dest_node"], simp add: dsneq dnz)+ apply (subst modify_map_addr_com [where y = src], simp add: dsneq dsneq' [symmetric] dnz)+ apply assumption done qed next case destsrc  (* Dual of srcdest *)

     let ?n' = "modify_map m dest (cteMDBNode_update (mdbNext_update (%_. (mdbNext src_node))))" note [simp] = neg_rtrancl_into_trancl [OF destsrc(2)] note [simp] = destsrc(2) have dsneq: "src \<noteq> mdbPrev dest_node" proof assume "src = mdbPrev dest_node" hence "m \<turnstile> src \<leadsto>\<^sup>* dest" by - (rule r_into_rtrancl, rule next_fold [where m = m, OF src], simp) thus False using destsrc by simp qed from src have n1 [simp]:"\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" by (rule neg_next_rtrancl_nx [OF _ neg_rtrancl_into_trancl]) fact+ have chain_n': "mdb_chain_0 ?n'" proof (cases "mdbNext src_node \<in> dom m") case True thus ?thesis using n1 by (rule mdb_chain_0_modify_map_next [OF chain no_0]) next case False thus ?thesis using src chain no_0 by - (drule (3) ndom_is_0D, simp, erule (1) mdb_chain_0_modify_map_0) qed from src dest have n4: "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node" using neg_next_rtrancl_np [OF _ _ _ no_0 dlist neg_rtrancl_into_trancl] by auto hence n2 [simp]: "\<not> ?n' \<turnstile> dest \<leadsto>\<^sup>* src" using sn dest by (auto dest: rtrancl_into_trancl2 simp: modify_map_lhs_rtrancl) hence n3: "mdbPrev dest_node \<in> dom m
      \<Longrightarrow> \<not> modify_map ?n' src (cteMDBNode_update (mdbNext_update (%_. dest))) \<turnstile> src \<leadsto>\<^sup>* mdbPrev dest_node" using dest dsneq src n1 by (simp add: modify_map_lhs_rtrancl modify_map_app) (rule n4) from destsrc(1) show ?thesis proof (cases rule: tranclE2') case base hence ds: "src = mdbNext dest_node" by (clarsimp simp: next_unfold' dest) hence d2: "dest2_node =  MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)" using dsneq unfolding dest2_node_def by simp let ?m' = "(modify_map
          (modify_map ?n' src (cteMDBNode_update (mdbNext_update (%_. dest))))
           (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src))))" let ?goal = "mdb_chain_0 ?m'" { assume d1: "mdbPrev dest_node \<in> dom m" and "mdbNext src_node \<in> dom m" hence ?goal apply (intro mdb_chain_0_modify_map_next) apply (auto simp: no_0 chain n1 n2 n3 [OF d1]) done } moreover { assume d1: "mdbPrev dest_node \<notin> dom m" and "mdbNext src_node \<in> dom m" hence ?goal by simp ((rule mdb_chain_0_modify_map_next)+, simp_all add: no_0 chain n1 n2) } moreover { assume d1: "mdbPrev dest_node \<in> dom m" and "mdbNext src_node \<notin> dom m" hence m0: "mdbNext src_node = 0" by (clarsimp dest!: src_next [where p = "mdbNext src_node", simplified]) have ?goal using chain_n' d1 src dest apply - apply (rule  mdb_chain_0_modify_map_next) apply (rule  mdb_chain_0_modify_map_next [OF chain_n']) apply (simp_all add: no_0 chain n1 n2  n3 [OF d1]) done } moreover { assume d1: "mdbPrev dest_node \<notin> dom m" and "mdbNext src_node \<notin> dom m" hence m0: "mdbNext src_node = 0" by (clarsimp dest!: src_next [where p = "mdbNext src_node", simplified]) have ?goal using d1 chain_n' apply simp apply (rule mdb_chain_0_modify_map_next) apply (simp_all add: no_0 chain n1 n2) done } ultimately have ?goal apply (cases "mdbPrev dest_node \<in> dom m") apply (cases "mdbNext src_node \<in> dom m") apply (auto)[2] apply (cases "mdbNext src_node \<in> dom m") apply auto done thus ?thesis using ds [symmetric] d2 neqs dsneq apply simp apply (subst modify_map_addr_com [where x = "mdbNext src_node"], simp)+ apply (subst modify_map_addr_com [OF neqs(1)]) apply (subst modify_map_comp [symmetric]) apply (simp) apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_addr_com [where x = src]) apply simp apply (rule mdb_chain_0_modify_map_replace) apply simp apply (subst modify_map_addr_com [where x = dest], simp)+ apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_addr_com [where y = src], simp)+ apply (subst modify_map_addr_com [where y = dest], simp)+ apply assumption done next case (trancl c) hence dsneq': "src \<noteq> mdbNext dest_node" using dest apply - apply rule apply simp apply (drule next_fold) apply simp apply (drule (1) next_single_value) apply simp done hence d2n: "dest2_node = dest_node" unfolding dest2_node_def using dsneq by simp from trancl obtain d where dnext: "m \<turnstile> d \<leadsto> src" and ncd: "m \<turnstile> c \<leadsto>\<^sup>* d" by (clarsimp dest!: tranclD2) have ddest: "d = mdbPrev (cteMDBNode (CTE src_cap src_node))" using src dlist no_0 dnext by (rule next_prev) hence d2: "mdbPrev src_node \<in> dom m" using dnext by (clarsimp simp: next_unfold') have dnz: "mdbPrev src_node \<noteq> 0" by (rule dom_into_not0 [OF no_0 d2]) have n5 [simp]: "\<not> ?n' \<turnstile> dest \<leadsto>\<^sup>* mdbPrev src_node" proof - have "dest \<noteq> mdbPrev src_node" by (simp add: dsneq' [simplified, symmetric]) hence "?n' \<turnstile> mdbPrev src_node \<leadsto> src" using sn [OF d2] by (clarsimp simp: next_unfold' modify_map_other) thus ?thesis using n2 by - (erule contrapos_nn, erule (1) rtrancl_into_rtrancl) qed let ?n2 = "modify_map ?n' (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest)))" have chain_n2: "mdb_chain_0 ?n2" by ((rule chain_n' | rule mdb_chain_0_modify_map_next)+, simp_all add: no_0) have r [simp]: "\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev src_node" by (rule neg_next_rtrancl_np [OF _ _ d2 no_0 dlist], rule src, rule src, simp) have r3 [simp]: "\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" by (rule neg_next_rtrancl_nx, rule src, simp) have r5 [simp]: "\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* dest" by (rule neg_next_rtrancl_nx, rule dest, simp) have r4 [simp]: "\<not> m \<turnstile> src \<leadsto>\<^sup>+ mdbPrev src_node" by (rule neg_next_trancl_xp [OF _ d2 no_0 dlist], rule src, simp) let ?m'' =
        "(modify_map (modify_map
          (modify_map ?n' (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))))
           (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src))))
          src (cteMDBNode_update (mdbNext_update (%_. (mdbNext dest_node)))))" have n2_2 [simp]:
        "?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node" apply (cases "mdbNext dest_node = mdbPrev src_node") apply simp apply (rule trancl_into_rtrancl) apply (rule next_modify_map_trancl_last [OF chain_n'], simp add: no_0) apply (subst modify_map_trancl_other_iff) apply simp apply (rule next_trancl_np [OF _ _ dlist no_0]) apply (rule dest, rule src) apply (simp add: dsneq' [simplified]) apply assumption apply (rule destsrc(1)) done hence n2_3 [simp]: "\<not> ?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ src" proof (rule neg_next_trancl_trancl) show "\<not> ?n2 \<turnstile> src \<leadsto>\<^sup>* mdbPrev src_node" apply (rule neg_rtranclI) apply simp apply (subst next_modify_map_trancl_last_iff [OF chain_n' chain_n2]) apply (simp add: no_0) apply (simp add: modify_map_trancl_other_iff) done show "\<not> ?n2 \<turnstile> mdbPrev src_node \<leadsto>\<^sup>* src" using d2 by (clarsimp simp: modify_map_lhs_rtrancl modify_map_other dsneq' [simplified, symmetric]) qed have r6 [simp]: "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> src \<leadsto>\<^sup>+ mdbPrev dest_node" by (rule neg_next_trancl_xp [OF _ _ no_0 dlist], rule dest, simp_all) have n2_4 [simp]:
        "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> ?n2 \<turnstile> src \<leadsto>\<^sup>* mdbPrev dest_node" apply - apply (rule neg_rtranclI [OF dsneq]) apply (subst modify_map_trancl_other_iff) apply (rule neg_rtranclI) apply (simp_all add: modify_map_trancl_other_iff) done let ?goal = "mdb_chain_0 ?m''" { assume d1: "mdbPrev dest_node \<in> dom m" and d3: "mdbNext dest_node \<in> dom m" have r2 [simp]: "\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node" using src dest by (rule neg_next_rtrancl_np [OF _ _ _ no_0 dlist neg_rtrancl_into_trancl]) fact+ have ?goal proof ((rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_next)+,
              simp_all add: no_0 chain n1 d1) have n2_1:
            "\<not> ?n2 \<turnstile> mdbPrev src_node \<leadsto>\<^sup>* mdbPrev dest_node" using d2  dsneq' [symmetric] apply - apply (erule domE) apply (subst modify_map_lhs_rtrancl) apply (clarsimp simp: modify_map_other) apply simp apply simp apply (simp add: dom_into_not0 [OF no_0 d2]) apply (subst modify_map_lhs_rtrancl, rule dest) apply simp apply (simp) done have "\<not> ?n' \<turnstile> mdbPrev dest_node \<leadsto>\<^sup>+ mdbPrev src_node" apply (rule neg_next_rtrancl_trancl [where y = dest]) apply (subst modify_map_lhs_rtrancl) apply (rule dest) apply simp apply (simp add: dsneq' [simplified]) apply (subst next_modify_map_last) apply simp apply (rule dp [OF d1]) done hence "mdbPrev dest_node \<noteq> 0 \<Longrightarrow> \<not> ?n2 \<turnstile> mdbPrev dest_node \<leadsto>\<^sup>* mdbPrev src_node" apply - apply (rule neg_rtranclI) apply simp apply (subst next_modify_map_trancl_last_iff [OF chain_n' chain_n2]) apply (simp add: no_0) apply assumption done moreover from no_0 have "mdbPrev dest_node \<noteq> 0" using d1 by auto ultimately show
            "\<not> modify_map ?n2 (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* src" using n2_1 dsneq' [symmetric] apply - apply (rule neg_rtranclI) apply (simp) apply (subst modify_map_trancl_other_iff) apply (rule neg_rtranclI) apply simp apply (rule neg_next_trancl_trancl [OF n2_2]) apply auto done qed fact+ } moreover { assume d1: "mdbPrev dest_node \<notin> dom m" and d3: "mdbNext dest_node \<in> dom m" have ?goal proof (simp add: d1, (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1) show "\<not> ?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* src" by (rule neg_rtranclI [OF _ n2_3], simp add: dsneq' [simplified]) qed fact+ } moreover { assume d1: "mdbPrev dest_node \<in> dom m" and d3: "mdbNext dest_node \<notin> dom m" hence m0: "mdbNext dest_node = 0" by (clarsimp dest!: dest_next [where p = "mdbNext dest_node", simplified]) have ?goal by (simp add: m0,
          (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_0 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1 d1) } moreover { assume d1: "mdbPrev dest_node \<notin> dom m" and d3: "mdbNext dest_node \<notin> dom m" hence m0: "mdbNext dest_node = 0" by (clarsimp dest!: dest_next [where p = "mdbNext dest_node", simplified]) have ?goal by (simp add: m0 d1,
          (rule chain_n' | rule chain_n2 | rule mdb_chain_0_modify_map_0 | rule mdb_chain_0_modify_map_next)+,
            simp_all add: no_0 chain n1 d1) } ultimately have ?goal apply (cases "mdbPrev dest_node \<in> dom m") apply (cases "mdbNext dest_node \<in> dom m") apply (auto)[2] apply (cases "mdbNext dest_node \<in> dom m") apply auto done thus ?thesis using no_0 d2n dsneq dsneq' apply simp apply (subst modify_map_addr_com [where y = "mdbPrev dest_node"]) apply simp apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_addr_com [where x = src], simp)+ apply (rule mdb_chain_0_modify_map_replace) apply simp apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_addr_com [where y = src], simp)+ apply (subst modify_map_addr_com [where y = "mdbPrev dest_node"], simp add: dnz)+ apply (subst modify_map_addr_com [where y = "mdbPrev src_node"], simp add: dnz)+ apply (subst modify_map_addr_com [where y = dest], simp add:  dnz)+ apply assumption done qed next case indep have indep_rt1: "\<not> m \<turnstile> src \<leadsto>\<^sup>* dest" by (rule neg_rtranclI, simp) fact+ have indep_rt2: "\<not> m \<turnstile> dest \<leadsto>\<^sup>* src" by (rule neg_rtranclI, simp) fact+ have dsneq: "src \<noteq> mdbPrev dest_node" proof assume "src = mdbPrev dest_node" hence "m \<turnstile> src \<leadsto>\<^sup>+ dest" by - (rule r_into_trancl, rule next_fold [where m = m, OF src], simp) thus False using indep by simp qed note [simp] = dsneq [simplified] have sdneq: "dest \<noteq> mdbPrev src_node" proof assume "dest = mdbPrev src_node" hence "m \<turnstile> dest \<leadsto>\<^sup>+ src" by - (rule r_into_trancl, rule next_fold [where m = m, OF dest], simp) thus False using indep by simp qed note [simp] = sdneq [simplified] have dsneq' [simp]: "dest \<noteq> mdbNext src_node" proof assume "dest = mdbNext src_node" hence "m \<turnstile> src \<leadsto>\<^sup>+ dest" apply - apply (rule r_into_trancl) apply (rule next_fold) apply (rule src) apply simp done thus False using indep by simp qed have dsnp: "mdbPrev src_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node" proof assume "mdbPrev src_node \<in> dom m" and "mdbNext dest_node = mdbPrev src_node" hence "m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node" by simp moreover have "m \<turnstile> dest \<leadsto> mdbNext dest_node" using dest by (rule next_fold, simp) moreover have "m \<turnstile> mdbPrev src_node \<leadsto> src" by (rule sn) fact+ ultimately have "m \<turnstile> dest \<leadsto>\<^sup>+ src" by auto thus False using indep by simp qed have d2n: "dest2_node = dest_node" unfolding dest2_node_def by (cases dest_node, simp) let ?n' = "modify_map m dest (cteMDBNode_update (mdbNext_update (%_. (mdbNext src_node))))" let ?n2 = "modify_map ?n' (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest)))" from src have n1 [simp]:"\<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* dest" by (rule neg_next_rtrancl_nx [OF _ neg_rtrancl_into_trancl]) (rule indep_rt1) have chain_n': "mdb_chain_0 ?n'" proof (cases "mdbNext src_node \<in> dom m") case True thus ?thesis using n1 by (rule mdb_chain_0_modify_map_next [OF chain no_0]) next case False thus ?thesis using src chain no_0 by - (drule (3) ndom_is_0D, simp, erule (1) mdb_chain_0_modify_map_0) qed have chain_n2: "mdb_chain_0 ?n2" apply (cases "mdbPrev src_node \<in> dom m") apply ((rule chain_n' | rule mdb_chain_0_modify_map_next)+, simp_all add: no_0) apply (subst modify_map_lhs_rtrancl) apply (rule dest) apply simp apply (simp add: sdneq [symmetric]) apply (rule neg_next_rtrancl_np [OF _ _ _ no_0 dlist]) apply (rule src, rule src) apply assumption apply simp apply (rule chain_n') done let ?m' = "(modify_map
       (modify_map ?n2
         src (cteMDBNode_update (mdbNext_update (%_. (mdbNext dest_node)))))
       (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (%_. src))))" have r1 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> src \<leadsto>\<^sup>+ mdbPrev src_node" apply (rule neg_next_trancl_xp) apply (rule src, assumption, rule no_0, rule dlist) apply simp done have r [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> ?n' \<turnstile> src \<leadsto>\<^sup>+ mdbPrev src_node" by (simp add: modify_map_trancl_other_iff [OF indep_rt1]) have r2 [simp]: "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node" using src dest indep neg_next_rtrancl_np [OF _ _ _ no_0 dlist] by auto have n2 [simp]: "\<not> ?n' \<turnstile> dest \<leadsto>\<^sup>* src" using sn dest by (auto dest: rtrancl_into_trancl2 simp: modify_map_lhs_rtrancl) have n5 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> ?n' \<turnstile> dest \<leadsto>\<^sup>* mdbPrev src_node" proof - assume d2: "mdbPrev src_node \<in> dom m" have "?n' \<turnstile> mdbPrev src_node \<leadsto> src" using sn [OF d2] by (clarsimp simp: next_unfold' modify_map_other) thus ?thesis using n2 by - (erule contrapos_nn, erule (1) rtrancl_into_rtrancl) qed have r4 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev src_node" apply (rule neg_next_trancl_np [OF _ _ _ no_0 dlist]) apply (rule dest) apply (rule src) apply assumption apply (rule indep(2)) done have r5 [simp]: "\<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* dest" by (rule neg_next_rtrancl_nx, rule dest, simp) have r6 [simp]: " \<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ src" by (rule neg_next_trancl_nx, rule dest, rule indep(2)) have r7 [simp]: " mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev dest_node" apply (rule neg_next_trancl_np [OF _ _ _ no_0 dlist]) apply (rule dest) apply (rule dest) apply assumption apply simp done have n6 [simp]: "\<not> ?n' \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ src" by (subst modify_map_trancl_other_iff) simp_all have n6_r [simp]: "\<not> ?n' \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* src" by (rule neg_rtranclI) (simp_all add: sdneq [symmetric]) have n2_3 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> ?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ src" apply (subst modify_map_trancl_other_iff) apply (rule neg_rtranclI) apply (simp add: dsnp) apply (subst modify_map_trancl_other_iff) apply (rule neg_next_rtrancl_nx) apply (rule dest) apply simp_all done have n7 [simp]: "mdbPrev src_node \<in> dom m \<Longrightarrow>  \<not> ?n' \<turnstile>  mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node" apply (rule neg_rtranclI) apply (erule dsnp) apply (subst modify_map_trancl_other_iff) apply simp_all done have n8 [simp]: "mdbPrev dest_node \<in> dom m
      \<Longrightarrow> \<not> ?n' \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev dest_node" by (simp add: modify_map_trancl_other_iff) have n2_5 [simp]: "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> ?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev dest_node" by (cases "mdbPrev src_node \<in> dom m", simp_all add: modify_map_trancl_other_iff) have n2_4 [simp]: "mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> ?n2 \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev dest_node" apply (frule dom_into_not0 [OF no_0]) apply (cases "mdbPrev src_node \<in> dom m") apply (rule neg_rtranclI) apply (drule dom_into_not0 [OF no_0]) apply simp apply simp apply simp apply (rule neg_rtranclI) apply simp apply simp done have n9 [simp]: "mdbPrev dest_node \<in> dom m \<Longrightarrow>
      \<not> modify_map ?n' src (cteMDBNode_update (mdbNext_update (%_. (mdbNext dest_node)))) \<turnstile> src \<leadsto>\<^sup>* mdbPrev dest_node" apply (subst modify_map_lhs_rtrancl) apply (simp add: src modify_map_other) apply simp apply simp apply (rule neg_rtranclI) apply (drule dom_into_not0 [OF no_0]) apply simp apply simp done have chain_n3: "mdbPrev src_node \<in> dom m \<Longrightarrow> mdb_chain_0
        (modify_map
          (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (%_. (mdbNext src_node)))))
            (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (%_. dest))))
          src (cteMDBNode_update (mdbNext_update (%_. (mdbNext dest_node)))))" apply - apply (cases "mdbNext dest_node \<in> dom m") apply (rule mdb_chain_0_modify_map_next [OF chain_n2]) apply (simp add: no_0) apply simp apply (rule neg_rtranclI) apply (simp add: sdneq [symmetric]) apply simp apply (frule ndom_is_0D [OF _ chain no_0]) apply (rule dest) apply simp apply (rule mdb_chain_0_modify_map_0 [OF chain_n2]) apply (simp_all add: no_0) done have "mdb_chain_0 ?m'" proof (cases rule: cases2 [of "mdbPrev src_node \<in> dom m" "mdbPrev dest_node \<in> dom m"]) case pos_pos thus ?thesis apply - apply (rule mdb_chain_0_modify_map_next [OF chain_n3]) apply (simp_all add: no_0) apply (subst modify_map_lhs_rtrancl) apply (simp add: modify_map_other src) apply simp apply (rule neg_rtranclI) apply (simp add: sdneq [symmetric]) apply simp apply simp done next case pos_neg thus ?thesis by simp (rule chain_n3) next case neg_pos thus ?thesis using no_0 apply - apply simp apply (cases "mdbNext dest_node \<in> dom m") apply (rule mdb_chain_0_modify_map_next) apply (rule mdb_chain_0_modify_map_next [OF chain_n']) apply simp_all apply (drule ndom_is_0D [OF _ chain no_0], rule dest) apply simp apply (rule mdb_chain_0_modify_map_next) apply (rule mdb_chain_0_modify_map_0 [OF chain_n']) apply simp_all apply (subst modify_map_lhs_rtrancl) apply (simp add: modify_map_other src) apply simp_all apply (rule no_0_no_0_lhs_rtrancl) apply simp apply (erule (1) dom_into_not0) done next case neg_neg thus ?thesis using no_0 apply - apply (cases "mdbNext dest_node \<in> dom m") apply simp apply (rule mdb_chain_0_modify_map_next [OF chain_n']) apply simp apply simp apply simp apply (drule ndom_is_0D [OF _ chain no_0], rule dest) apply simp apply (rule mdb_chain_0_modify_map_0 [OF chain_n']) apply simp done qed thus ?thesis using d2n apply simp apply (subst modify_map_addr_com [where x = dest], simp)+ apply (rule mdb_chain_0_modify_map_replace) apply (subst modify_map_addr_com [where x = src], simp)+ apply (rule mdb_chain_0_modify_map_replace) apply simp apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_addr_com [where y = dest], simp add: sdneq [symmetric])+ apply (subst modify_map_addr_com [where y = src], simp) apply assumption done qed thus ?thesis unfolding n_def n'_def apply (simp add: const_def) apply (rule mdb_chain_0_modify_map_prev) apply (subst modify_map_com [where g = "cteCap_update (%_. scap)"], case_tac x, simp)+ apply (rule mdb_chain_0_modify_map_inv) apply (subst modify_map_com [where g = "cteCap_update (%_. dcap)"], case_tac x, simp)+ apply (rule mdb_chain_0_modify_map_inv) apply simp_all done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 n proof (state)
goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 m proof (prove)
using this:
valid_mdb_ctes m

goal (1 subgoal):
 1. mdb_chain_0 m proof (state)
this:
mdb_chain_0 m

goal (1 subgoal):
 1. mdb_chain_0 n proof (state)
goal (1 subgoal):
 1. mdb_chain_0 n proof (state)
goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. src \<in> dom m proof (state)
this:
src \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. dest \<in> dom m proof (state)
this:
dest \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (prove)
using this:
mdbPrev dest_node \<in> dom m
no_0 m

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
mdbPrev dest_node \<noteq> 0
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (1 subgoal):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE dest_cap dest_node); m (mdbPrev dest_node) = Some (CTE cap node); dest = mdbNext node\<rbrakk> \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> mdbNext node proof (prove)
goal (1 subgoal):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE dest_cap dest_node); dest = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) = mdbNext node proof (prove)
goal:
No subgoals! proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. (dest, dest) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
using this:
no_loops m

goal (1 subgoal):
 1. (dest, dest) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
(dest, dest) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. (src, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
using this:
no_loops m

goal (1 subgoal):
 1. (src, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
(src, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. (mdbNext src_node, src) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (prove)
using this:
mdbPrev src_node \<in> dom m
no_0 m

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (state)
this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
mdbPrev src_node \<noteq> 0
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; m src = Some (CTE src_cap src_node)\<rbrakk> \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (1 subgoal):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); m (mdbPrev src_node) = Some (CTE cap node); src = mdbNext node\<rbrakk> \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> mdbNext node proof (prove)
goal (1 subgoal):
 1. \<And>cap node. \<lbrakk>m (mdbNext node) = Some (CTE src_cap src_node); src = mdbNext node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap node)) = mdbNext node proof (prove)
goal:
No subgoals! proof (state)
this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. mdb_chain_0 n proof (chain)
picking this:
mdb_chain_0 m
no_0 m
dest \<noteq> src proof (prove)
using this:
mdb_chain_0 m
no_0 m
dest \<noteq> src

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ dest
(dest, src) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> dest \<leadsto>\<^sup>* 0

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
(dest, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. dest \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
dest = mdbPrev src_node

goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
dest = mdbPrev src_node

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto>\<^sup>* src proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>* src

goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>* src

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>* src
m \<turnstile> src \<leadsto>\<^sup>+ dest
(dest, src) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> dest \<leadsto>\<^sup>* 0

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
dest \<noteq> mdbPrev src_node

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m dest = Some (CTE dest_cap dest_node) proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. mdbNext dest_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdbNext dest_node \<in> dom m

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. mdbNext dest_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
using this:
mdbNext dest_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
using this:
mdbNext dest_node \<in> dom m
(mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. mdbNext dest_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
goal (1 subgoal):
 1. mdbNext dest_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext dest_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
using this:
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
using this:
mdbNext dest_node \<notin> dom m
m dest = Some (CTE dest_cap dest_node)
mdb_chain_0 m
no_0 m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node) proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
\<lbrakk>m ?ptr = Some (CTE ?cap ?node); m ?ptr' = Some (CTE ?cap' ?node'); mdbPrev ?node' \<in> dom m; (?ptr, ?ptr') \<notin> (mdb_next_rel m)\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext ?node, mdbPrev ?node') \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. (src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
using this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> dest \<leadsto> mdbNext dest_node
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. (src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (state)
this:
(src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
(src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
using this:
(src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
m dest = Some (CTE dest_cap dest_node)
dest \<noteq> mdbPrev src_node
m src = Some (CTE src_cap src_node)
(mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (3 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto>\<^sup>+ dest; (dest, src) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> dest \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> src \<leadsto> dest

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
m \<turnstile> src \<leadsto> dest

goal (1 subgoal):
 1. dest = mdbNext src_node proof (state)
this:
dest = mdbNext src_node

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
dest = mdbNext src_node

goal (1 subgoal):
 1. dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (prove)
using this:
dest = mdbNext src_node
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (prove)
using this:
dest = mdbNext src_node
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (state)
this:
dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbNext dest_node \<in> dom m

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbNext dest_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 m
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 m
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom m
 4. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>*
 5. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 6. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 7. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 8. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 9. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 10. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbNext dest_node \<in> dom m

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbNext dest_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbNext dest_node \<notin> dom m

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext dest_node = 0 proof (state)
this:
mdbNext dest_node = 0

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
using this:
mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
mdbPrev src_node \<in> dom m
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 4. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (6 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 3. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 4. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 5. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 6. \<lbrakk>mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev src_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbNext dest_node \<notin> dom m

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext dest_node = 0 proof (state)
this:
mdbNext dest_node = 0

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))\<rbrakk> \<Longrightarrow> no_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdb_chain_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))\<rbrakk> \<Longrightarrow> (src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
using this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 3. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbPrev src_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (2 subgoals):
 1. m \<turnstile> src \<leadsto> dest \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
mdbNext src_node = dest
dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)
src \<noteq> dest
dest \<noteq> src
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (\<lambda>m. src_node))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) dest (cteMDBNode_update (\<lambda>m. src_node))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (\<lambda>m. src_node) \<circ> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) \<circ> (cteMDBNode_update (\<lambda>m. src_node) \<circ> cteMDBNode_update (mdbPrev_update (\<lambda>_. dest))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src) \<circ> (\<lambda>m. src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (\<lambda>x. mdbNext_update (\<lambda>_. src) src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (mdbNext_update (\<lambda>_. src) src_node))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))); mdbNext src_node = dest; dest2_node = MDB (mdbNext dest_node) dest (mdbRevocable dest_node) (mdbFirstBadged dest_node); dest \<noteq> mdbPrev src_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> src \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
m \<turnstile> src \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. dest \<noteq> mdbNext src_node proof (prove)
using this:
m \<turnstile> src \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ dest
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. dest \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest; m src = Some (CTE src_cap src_node)\<rbrakk> \<Longrightarrow> dest \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest; m src = Some (CTE src_cap src_node); dest = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext src_node; m src = Some (CTE src_cap src_node); dest = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext src_node; dest = mdbNext src_node\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE src_cap src_node)) = ?b5
 2. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext src_node; dest = mdbNext src_node; m \<turnstile> src \<leadsto> ?b5\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext src_node; dest = mdbNext src_node; m \<turnstile> src \<leadsto> mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> c \<leadsto>\<^sup>+ mdbNext src_node; dest = mdbNext src_node; m \<turnstile> src \<leadsto> mdbNext src_node; c = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
dest \<noteq> mdbNext src_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
dest \<noteq> mdbNext src_node

goal (1 subgoal):
 1. dest2_node = dest_node proof (prove)
using this:
dest \<noteq> mdbNext src_node

goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = dest_node proof (state)
this:
dest2_node = dest_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m \<turnstile> src \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ dest proof (prove)
using this:
m \<turnstile> src \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. (\<And>d. \<lbrakk>m \<turnstile> d \<leadsto> dest; m \<turnstile> c \<leadsto>\<^sup>* d\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m \<turnstile> d \<leadsto> dest
m \<turnstile> c \<leadsto>\<^sup>* d

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. d = mdbPrev (cteMDBNode (CTE dest_cap dest_node)) proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
valid_dlist m
no_0 m
m \<turnstile> d \<leadsto> dest

goal (1 subgoal):
 1. d = mdbPrev (cteMDBNode (CTE dest_cap dest_node)) proof (state)
this:
d = mdbPrev (cteMDBNode (CTE dest_cap dest_node))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
d = mdbPrev (cteMDBNode (CTE dest_cap dest_node))

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m proof (prove)
using this:
d = mdbPrev (cteMDBNode (CTE dest_cap dest_node))
m \<turnstile> d \<leadsto> dest

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m proof (state)
this:
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (state)
goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. src \<noteq> mdbPrev dest_node proof (state)
this:
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
using this:
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
src \<noteq> mdbPrev dest_node
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
using this:
modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
using this:
modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest
(src, dest) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal (1 subgoal):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (state)
this:
(src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal:
No subgoals! proof (state)
this:
(src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
(dest, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node proof (prove)
goal (2 subgoals):
 1. mdbNext src_node = mdbPrev dest_node \<Longrightarrow> modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ mdbPrev dest_node proof (prove)
goal (2 subgoals):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> (mdbNext src_node, src) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> mdbNext src_node \<leadsto>\<^sup>+ mdbPrev dest_node proof (prove)
goal (5 subgoals):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m ?ptr6 = Some (CTE ?cap6 src_node)
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m ?ptr'6 = Some (CTE ?cap'6 dest_node)
 3. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> mdbPrev dest_node \<noteq> ?ptr6
 4. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node
 5. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> ?ptr6 \<leadsto>\<^sup>+ ?ptr'6 proof (prove)
goal (3 subgoals):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> mdbPrev dest_node \<noteq> src
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node
 3. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
goal (2 subgoals):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
goal:
No subgoals! proof (state)
this:
modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))) \<turnstile> mdbNext src_node \<leadsto>\<^sup>* mdbPrev dest_node

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (state)
goal (2 subgoals):
 1. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
 2. (mdbPrev dest_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. dest \<noteq> mdbPrev dest_node
 2. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. no_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
(dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (1 subgoal):
 1. (mdbPrev dest_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev dest_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
using this:
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. (mdbPrev dest_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (state)
this:
(mdbPrev dest_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal:
No subgoals! proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> dest \<noteq> mdbPrev dest_node
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
using this:
mdbPrev dest_node \<in> dom m
mdbNext src_node \<noteq> dest

goal (1 subgoal):
 1. (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) (mdbPrev dest_node) = Some (?cte4 r)
 2. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) (?cte4 r))), mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 3. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = mdbPrev dest_node \<or> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) (?cte4 r))) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> r = ?cte4 r
 2. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) (?cte4 r))), mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 3. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = mdbPrev dest_node \<or> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) (?cte4 r))) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal (2 subgoals):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) r)), mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 2. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = mdbPrev dest_node \<or> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) r)) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = mdbPrev dest_node \<or> modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. src)) r)) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))), src) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = src \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext src_node \<noteq> dest; m (mdbPrev dest_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev src_node = src \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev src_node) proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 2. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (4 subgoals):
 1. m src = Some ?cte4
 2. (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte4)), src) \<notin> (mdb_next_rel m)\<^sup>*
 3. \<not> (mdbPrev dest_node = src \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte4)) \<leadsto>\<^sup>* mdbPrev dest_node)
 4. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (3 subgoals):
 1. (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))), src) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<not> (mdbPrev dest_node = src \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node)
 3. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (2 subgoals):
 1. \<not> (mdbPrev dest_node = src \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node)
 2. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (1 subgoal):
 1. modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<noteq> src
 2. m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
using this:
(mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> no_0 (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (state)
this:
mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (chain)
picking this:
no_0 m proof (prove)
using this:
no_0 m

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (prove)
using this:
no_0 m
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (state)
this:
mdbPrev src_node \<noteq> 0

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (chain)
picking this:
mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
mdbPrev src_node \<noteq> 0 proof (prove)
using this:
mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
using this:
mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
mdbPrev src_node \<noteq> 0
(mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> dest
 2. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev src_node
 2. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+
 3. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+
 2. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<noteq> 0 \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*; mdbPrev src_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (1 subgoal):
 1. mdbNext src_node \<in> dom m proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext src_node \<in> dom m
 2. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (1 subgoal):
 1. mdbNext src_node \<in> dom m proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node = 0 proof (state)
this:
mdbNext src_node = 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node = 0 proof (state)
this:
mdbNext src_node = 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
\<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); \<lbrakk>mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev src_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> src \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
no_0 m
dest2_node = dest_node

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> dest \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> src \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. dest_node))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. dest_node))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (\<lambda>m. dest_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (\<lambda>m. dest_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); no_0 m; dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ src
(src, dest) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> src \<leadsto>\<^sup>* 0

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ src
(src, dest) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> src \<leadsto>\<^sup>* 0

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
(src, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. src \<noteq> mdbPrev dest_node proof (state)
goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
src = mdbPrev dest_node

goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
src = mdbPrev dest_node

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>* dest proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>* dest

goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>* dest

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>* dest
m \<turnstile> dest \<leadsto>\<^sup>+ src
(src, dest) \<notin> (mdb_next_rel m)\<^sup>*
m \<turnstile> src \<leadsto>\<^sup>* 0

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
src \<noteq> mdbPrev dest_node

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m src = Some (CTE src_cap src_node) proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdbNext src_node \<in> dom m

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<in> dom m
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<notin> dom m
m src = Some (CTE src_cap src_node)
mdb_chain_0 m
no_0 m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node) proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
\<lbrakk>m ?ptr = Some (CTE ?cap ?node); m ?ptr' = Some (CTE ?cap' ?node'); mdbPrev ?node' \<in> dom m; (?ptr, ?ptr') \<notin> (mdb_next_rel m)\<^sup>*\<rbrakk> \<Longrightarrow> (mdbNext ?node, mdbPrev ?node') \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*
mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
using this:
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
m dest = Some (CTE dest_cap dest_node)
src \<noteq> mdbPrev dest_node
m src = Some (CTE src_cap src_node)
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto>\<^sup>+ src; (src, dest) \<notin> (mdb_next_rel m)\<^sup>*; m \<turnstile> src \<leadsto>\<^sup>* 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m \<turnstile> dest \<leadsto>\<^sup>+ src proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> dest \<leadsto> src

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
m \<turnstile> dest \<leadsto> src

goal (1 subgoal):
 1. src = mdbNext dest_node proof (state)
this:
src = mdbNext dest_node

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
src = mdbNext dest_node

goal (1 subgoal):
 1. dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (prove)
using this:
src = mdbNext dest_node
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (prove)
using this:
src = mdbNext dest_node
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) proof (state)
this:
dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<in> dom m
mdbNext src_node \<in> dom m

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<in> dom m
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 m
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 m
 3. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext src_node \<in> dom m
 4. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*
 5. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 6. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 7. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 8. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 9. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 10. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<notin> dom m
mdbNext src_node \<in> dom m

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<notin> dom m
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<in> dom m
mdbNext src_node \<notin> dom m

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<in> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node = 0 proof (state)
this:
mdbNext src_node = 0

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
mdbPrev dest_node \<in> dom m
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 3. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 4. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (6 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 4. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 5. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 6. \<lbrakk>mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))); mdbPrev dest_node \<in> dom m; m src = Some (CTE src_cap src_node); m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<notin> dom m
mdbNext src_node \<notin> dom m

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<notin> dom m
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node = 0 proof (state)
this:
mdbNext src_node = 0

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<notin> dom m
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<notin> dom m; mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<notin> dom m; mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev dest_node \<notin> dom m; mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdbPrev dest_node \<notin> dom m; mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))\<rbrakk> \<Longrightarrow> dest \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 4. \<lbrakk>mdbPrev dest_node \<notin> dom m; mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))\<rbrakk> \<Longrightarrow> (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev dest_node \<notin> dom m; mdbNext src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. m \<turnstile> dest \<leadsto> src \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
mdbNext dest_node = src
dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)
src \<noteq> dest
dest \<noteq> src
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node) \<circ> cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> src \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (\<lambda>m. MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node)))))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); mdbPrev src_node = dest; dest2_node = MDB dest (mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node); mdbNext src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
m \<turnstile> dest \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
m \<turnstile> dest \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. src \<noteq> mdbNext dest_node proof (prove)
using this:
m \<turnstile> dest \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ src
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. src \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src; m dest = Some (CTE dest_cap dest_node)\<rbrakk> \<Longrightarrow> src \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src; m dest = Some (CTE dest_cap dest_node); src = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext dest_node; m dest = Some (CTE dest_cap dest_node); mdbPrev src_node = dest\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext dest_node; mdbPrev src_node = dest\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE dest_cap dest_node)) = ?b5
 2. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext dest_node; mdbPrev src_node = dest; m \<turnstile> dest \<leadsto> ?b5\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ mdbNext dest_node; mdbPrev src_node = dest; m \<turnstile> dest \<leadsto> mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<lbrakk>m \<turnstile> c \<leadsto>\<^sup>+ mdbNext dest_node; mdbPrev src_node = dest; m \<turnstile> dest \<leadsto> mdbNext dest_node; c = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals! proof (state)
this:
src \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
src \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. dest2_node = dest_node proof (prove)
using this:
src \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = dest_node proof (prove)
using this:
src \<noteq> mdbNext dest_node
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = dest_node proof (state)
this:
dest2_node = dest_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m \<turnstile> dest \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ src proof (prove)
using this:
m \<turnstile> dest \<leadsto> c
m \<turnstile> c \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. (\<And>d. \<lbrakk>m \<turnstile> d \<leadsto> src; m \<turnstile> c \<leadsto>\<^sup>* d\<rbrakk> \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m \<turnstile> d \<leadsto> src
m \<turnstile> c \<leadsto>\<^sup>* d

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. d = mdbPrev (cteMDBNode (CTE src_cap src_node)) proof (prove)
using this:
m src = Some (CTE src_cap src_node)
valid_dlist m
no_0 m
m \<turnstile> d \<leadsto> src

goal (1 subgoal):
 1. d = mdbPrev (cteMDBNode (CTE src_cap src_node)) proof (state)
this:
d = mdbPrev (cteMDBNode (CTE src_cap src_node))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
d = mdbPrev (cteMDBNode (CTE src_cap src_node))

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m proof (prove)
using this:
d = mdbPrev (cteMDBNode (CTE src_cap src_node))
m \<turnstile> d \<leadsto> src

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m proof (state)
this:
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (state)
this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. dest \<noteq> mdbPrev src_node proof (state)
this:
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
dest \<noteq> mdbPrev src_node
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
(dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal:
No subgoals! proof (state)
this:
(dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (src, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
(src, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node proof (prove)
goal (2 subgoals):
 1. mdbNext dest_node = mdbPrev src_node \<Longrightarrow> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev src_node proof (prove)
goal (2 subgoals):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> (mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbPrev src_node proof (prove)
goal (5 subgoals):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m ?ptr6 = Some (CTE ?cap6 dest_node)
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m ?ptr'6 = Some (CTE ?cap'6 src_node)
 3. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> mdbPrev src_node \<noteq> ?ptr6
 4. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node
 5. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> ?ptr6 \<leadsto>\<^sup>+ ?ptr'6 proof (prove)
goal (3 subgoals):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> mdbPrev src_node \<noteq> dest
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node
 3. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src proof (prove)
goal (2 subgoals):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> m \<turnstile> dest \<leadsto>\<^sup>+ src proof (prove)
goal:
No subgoals! proof (state)
this:
modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node

goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (state)
goal (2 subgoals):
 1. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. (mdbPrev src_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. src \<noteq> mdbPrev src_node
 2. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
(src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (1 subgoal):
 1. (mdbPrev src_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev src_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
using this:
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. (mdbPrev src_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (state)
this:
(mdbPrev src_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal:
No subgoals! proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> src \<noteq> mdbPrev src_node
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+
 3. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<in> dom m
mdbNext dest_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbNext dest_node \<noteq> src

goal (1 subgoal):
 1. (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) (mdbPrev src_node) = Some (?cte4 r)
 2. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) (?cte4 r))), mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = mdbPrev src_node \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) (?cte4 r))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (3 subgoals):
 1. \<And>r. \<lbrakk>mdbPrev src_node \<noteq> dest; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> r = ?cte4 r
 2. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) (?cte4 r))), mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = mdbPrev src_node \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) (?cte4 r))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) r)), mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = mdbPrev src_node \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) r)) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbNext dest_node \<noteq> src; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = mdbPrev src_node \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)) r)) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbPrev src_node \<noteq> dest; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (dest, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<And>r. \<lbrakk>mdbPrev src_node \<noteq> dest; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))), dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<And>r. \<lbrakk>mdbPrev src_node \<noteq> dest; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. \<And>r. \<lbrakk>mdbPrev src_node \<noteq> dest; m (mdbPrev src_node) = Some r\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (4 subgoals):
 1. m dest = Some ?cte4
 2. (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) ?cte4)), dest) \<notin> (mdb_next_rel m)\<^sup>*
 3. \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) ?cte4)) \<leadsto>\<^sup>* mdbPrev src_node)
 4. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (3 subgoals):
 1. (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))), dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (2 subgoals):
 1. \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 2. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (1 subgoal):
 1. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<noteq> dest
 2. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
using this:
(mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> mdbPrev dest_node \<noteq> mdbPrev src_node
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (state)
this:
mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (chain)
picking this:
no_0 m proof (prove)
using this:
no_0 m

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (prove)
using this:
no_0 m
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (chain)
picking this:
mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
mdbPrev dest_node \<noteq> 0 proof (prove)
using this:
mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
using this:
mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
mdbPrev dest_node \<noteq> 0
(mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
mdbNext dest_node \<noteq> src

goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> src
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 3. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 3. \<lbrakk>mdbPrev dest_node \<noteq> 0 \<Longrightarrow> (mdbPrev dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbPrev dest_node \<noteq> 0; (mdbPrev src_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*; mdbNext dest_node \<noteq> src\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))))\<^sup>*

goal (1 subgoal):
 1. mdbNext dest_node \<in> dom m proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<notin> dom m
mdbNext dest_node \<in> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext dest_node \<in> dom m
 2. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (1 subgoal):
 1. mdbNext dest_node \<in> dom m proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<in> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<in> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext dest_node = 0 proof (state)
this:
mdbNext dest_node = 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev dest_node \<notin> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev dest_node \<notin> dom m
mdbNext dest_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext dest_node = 0 proof (state)
this:
mdbNext dest_node = 0

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
using this:
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
\<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 3. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>\<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); \<lbrakk>mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); mdbPrev dest_node \<notin> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<And>c. \<lbrakk>m \<turnstile> dest \<leadsto> c; m \<turnstile> c \<leadsto>\<^sup>+ src\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
no_0 m
dest2_node = dest_node
src \<noteq> mdbPrev dest_node
src \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> dest \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (\<lambda>m. dest_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))); no_0 m; dest2_node = dest_node; mdbNext src_node \<noteq> dest; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (src, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(src, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (dest, src) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(dest, src) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. src \<noteq> mdbPrev dest_node proof (state)
goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
src = mdbPrev dest_node

goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
src = mdbPrev dest_node

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ dest proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. src = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ dest
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
src \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbNext src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. dest \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
dest = mdbPrev src_node

goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
dest = mdbPrev src_node

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto>\<^sup>+ src proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. dest = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ src
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
dest \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. dest \<noteq> mdbNext src_node proof (state)
goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> False proof (state)
this:
dest = mdbNext src_node

goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> False proof (prove)
using this:
dest = mdbNext src_node

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> m \<turnstile> src \<leadsto>\<^sup>+ dest proof (prove)
goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> m \<turnstile> src \<leadsto> dest proof (prove)
goal (2 subgoals):
 1. dest = mdbNext src_node \<Longrightarrow> m src = Some ?cte3
 2. dest = mdbNext src_node \<Longrightarrow> mdbNext (cteMDBNode ?cte3) = dest proof (prove)
goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> mdbNext (cteMDBNode (CTE src_cap src_node)) = dest proof (prove)
goal:
No subgoals! proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. dest = mdbNext src_node \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ dest

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ dest
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
dest \<noteq> mdbNext src_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
mdbPrev src_node \<in> dom m
mdbNext dest_node = mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbNext dest_node = mdbPrev src_node

goal (1 subgoal):
 1. m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node
m \<turnstile> dest \<leadsto> mdbNext dest_node
m \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>* mdbPrev src_node
m \<turnstile> dest \<leadsto> mdbNext dest_node
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto>\<^sup>+ src proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node = mdbPrev src_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ src
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. dest2_node = dest_node proof (prove)
goal (1 subgoal):
 1. MDB (if dest = mdbPrev src_node then dest else mdbNext dest_node) (if dest = mdbNext src_node then dest else mdbPrev dest_node) (mdbRevocable dest_node) (mdbFirstBadged dest_node) = dest_node proof (state)
this:
dest2_node = dest_node

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (chain)
picking this:
m src = Some (CTE src_cap src_node) proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. (mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (2 subgoals):
 1. mdbNext src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdbNext src_node \<in> dom m

goal (2 subgoals):
 1. mdbNext src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<in> dom m
(mdbNext src_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdbNext src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<notin> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
using this:
mdbNext src_node \<notin> dom m
m src = Some (CTE src_cap src_node)
mdb_chain_0 m
no_0 m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (4 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m dest = Some ?cte7
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) ?cte7)), dest) \<notin> (mdb_next_rel m)\<^sup>*
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) ?cte7)) \<leadsto>\<^sup>* mdbPrev src_node)
 4. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))), dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 3. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev src_node = dest \<or> m \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)) (CTE dest_cap dest_node))) \<leadsto>\<^sup>* mdbPrev src_node)
 2. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (5 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr9 = Some (CTE ?cap9 src_node)
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr'9 = Some (CTE ?cap'9 src_node)
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 4. mdbPrev src_node \<in> dom m \<Longrightarrow> (?ptr9, ?ptr'9) \<notin> (mdb_next_rel m)\<^sup>+
 5. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, src) \<notin> (mdb_next_rel m)\<^sup>+
 3. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, src) \<notin> (mdb_next_rel m)\<^sup>+
 2. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<notin> dom m \<Longrightarrow> mdb_chain_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (5 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr' = Some (CTE ?cap src_node)
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> no_0 m
 4. mdbPrev src_node \<in> dom m \<Longrightarrow> valid_dlist m
 5. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (src, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
(src, dest) \<notin> (mdb_next_rel m)\<^sup>+
(dest, src) \<notin> (mdb_next_rel m)\<^sup>+
\<lbrakk>m ?ptr = Some (CTE ?cap ?node); m ?ptr' = Some (CTE ?cap' ?node'); mdbPrev ?node' \<in> dom m; (?ptr, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> (mdbNext ?node, mdbPrev ?node') \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext src_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
mdbPrev src_node \<in> dom m \<Longrightarrow> m \<turnstile> mdbPrev src_node \<leadsto> src
m dest = Some (CTE dest_cap dest_node)

goal (1 subgoal):
 1. (dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
mdbPrev src_node \<in> dom m

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (prove)
using this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
using this:
modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbPrev src_node \<leadsto> src
(dest, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
(dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (4 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr = Some (CTE ?cap dest_node)
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr' = Some (CTE ?cap' src_node)
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 4. mdbPrev src_node \<in> dom m \<Longrightarrow> (?ptr, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr' = Some (CTE ?cap' src_node)
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbPrev src_node \<in> dom m
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>* proof (state)
this:
(mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>+ proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (4 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m ?ptr = Some (CTE ?cap dest_node)
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> m ?ptr' = Some (CTE ?cap' dest_node)
 3. mdbPrev dest_node \<in> dom m \<Longrightarrow> mdbPrev dest_node \<in> dom m
 4. mdbPrev dest_node \<in> dom m \<Longrightarrow> (?ptr, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> m ?ptr' = Some (CTE ?cap' dest_node)
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> mdbPrev dest_node \<in> dom m
 3. mdbPrev dest_node \<in> dom m \<Longrightarrow> (dest, ?ptr') \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> mdbPrev dest_node \<in> dom m
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (dest, dest) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (dest, dest) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel m)\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (state)
this:
(mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (4 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> m ?ptr5 = Some (CTE ?cap5 dest_node)
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (?ptr5, dest) \<notin> (mdb_next_rel m)\<^sup>+
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+
 4. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (3 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (dest, dest) \<notin> (mdb_next_rel m)\<^sup>+
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+
 3. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, dest) \<notin> (mdb_next_rel m)\<^sup>*
 2. mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel m)\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev src_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+ proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 3. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m; mdbPrev dest_node \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 3. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<in> dom m; mdbPrev dest_node \<noteq> 0; mdbPrev src_node \<notin> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) src = Some ?cte
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte)), src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte)) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))), src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (2 subgoals):
 1. mdbPrev dest_node \<noteq> 0 \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev dest_node
 2. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<in> dom m \<Longrightarrow> (mdbNext dest_node, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>+ proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev dest_node \<in> dom m \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 4. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> src
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> m ?ptr8 = Some (CTE ?cap8 dest_node)
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbNext dest_node \<notin> dom m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; 0 \<notin> dom m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; 0 \<notin> dom m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev src_node \<in> dom m \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbPrev dest_node \<in> dom m

goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbPrev src_node \<in> dom m
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 4. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) src = Some ?cte7
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte7)), src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) ?cte7)) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))), src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> src
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 3. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))))\<^sup>+
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<in> dom m
mdbPrev dest_node \<notin> dom m

goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<in> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<in> dom m
mdbPrev dest_node \<notin> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<in> dom m

goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<in> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<in> dom m
no_0 m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (5 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 5. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (7 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 5. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 6. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))))\<^sup>*
 7. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>* proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> src \<in> dom (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0))))
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>* proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (src, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))))\<^sup>* proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) src = Some ?cte24
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)) ?cte24)), src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)) ?cte24)) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)) (CTE src_cap src_node))), src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> \<not> (mdbPrev dest_node = src \<or> modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))) \<turnstile> mdbNext (cteMDBNode (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)) (CTE src_cap src_node))) \<leadsto>\<^sup>* mdbPrev dest_node) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> (0, mdbPrev dest_node) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>* proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdbPrev dest_node \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<in> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdbPrev dest_node \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (state)
this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<notin> dom m

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<notin> dom m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdbPrev src_node \<notin> dom m
mdbPrev dest_node \<notin> dom m
no_0 m

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 4. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> mdbNext dest_node \<in> dom (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node))))
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 3. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<in> dom m\<rbrakk> \<Longrightarrow> (mdbNext dest_node, src) \<notin> (mdb_next_rel (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))))\<^sup>*
 2. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node \<notin> dom m\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. 0)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<notin> dom m; mdbPrev dest_node \<notin> dom m; no_0 m; mdbNext dest_node = 0\<rbrakk> \<Longrightarrow> no_0 (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. \<lbrakk>(src, dest) \<notin> (mdb_next_rel m)\<^sup>+; (dest, src) \<notin> (mdb_next_rel m)\<^sup>+\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
dest2_node = dest_node

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (\<lambda>m. src_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest_node))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (\<lambda>m. dest_node))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))); dest2_node = dest_node\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map m dest (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext src_node)))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) src (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext dest_node)))) (mdbPrev dest_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal:
No subgoals! proof (state)
this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 n proof (prove)
using this:
mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))

goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. dcap))) dest (cteCap_update (\<lambda>_. scap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (const (cteMDBNode dest2)))) dest (cteMDBNode_update (const src_node))) (mdbPrev (cteMDBNode dest2)) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbNext (cteMDBNode dest2)) (cteMDBNode_update (mdbPrev_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. dcap))) dest (cteCap_update (\<lambda>_. scap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) (mdbNext dest2_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. dcap))) dest (cteCap_update (\<lambda>_. scap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) proof (prove)
goal (1 subgoal):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. dcap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) dest (cteCap_update (\<lambda>_. scap))) proof (prove)
goal (2 subgoals):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m src (cteCap_update (\<lambda>_. dcap))) (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. scap) cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal (2 subgoals):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) src (cteCap_update (\<lambda>_. dcap)))
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. scap) cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal (3 subgoals):
 1. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>y. dest2_node))) dest (cteMDBNode_update (\<lambda>y. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src))))
 2. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. dcap) cte)) = mdbNext (cteMDBNode cte)
 3. \<And>cte. mdb_chain_0 (modify_map (modify_map (modify_map (modify_map (modify_map m (mdbPrev src_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. dest)))) (mdbNext src_node) (cteMDBNode_update (mdbPrev_update (\<lambda>_. dest)))) src (cteMDBNode_update (\<lambda>m. dest2_node))) dest (cteMDBNode_update (\<lambda>m. src_node))) (mdbPrev dest2_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. src)))) \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. scap) cte)) = mdbNext (cteMDBNode cte) proof (prove)
goal:
No subgoals! proof (state)
this:
mdb_chain_0 n

goal:
No subgoals!