theory CNodeInv_R

lemma (in mdb_swap) cteSwap_dlist_helper:
  shows "valid_dlist n" proof fix p cte assume np: "n p = Some cte" and n0: "mdbPrev (cteMDBNode cte) \<noteq> 0" let ?thesis =
    "\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p" let ?mn = "mdbPrev (cteMDBNode cte)" note p_prev_qe_src = mdb_ptr_src.p_prev_qe note annoying_simps [simp del]
    = next_dest_prev_src  next_dest_prev_src_sym prev_dest_next_src prev_dest_next_src_sym note really_annoying_simps [simp del] = word_neq_0_conv from np have domn: "p \<in> dom n" by (rule domI) then obtain ctep where mp: "m p = Some ctep" by (clarsimp simp add: dom_n_m) have dd: "mdbPrev (cteMDBNode cte) \<in> dom n" by (subst dom_n_m, rule prev_not0_into_dom) fact+ then obtain cte' where mmn: "m (mdbPrev (cteMDBNode cte)) = Some cte'" by (clarsimp simp add: dom_n_m) have dest_src_pn: "\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest \<rbrakk>
    \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node" proof (rule not_sym, rule) assume "mdbPrev src_node = mdbNext dest_node" and "mdbPrev src_node \<noteq> 0"
      and msd: "mdbNext src_node = dest" hence "m \<turnstile> mdbNext dest_node \<leadsto> src" by (auto dest!: src_prev intro: next_fold) also have "m \<turnstile> src \<leadsto> dest" using src next_fold msd by auto also have "m \<turnstile> dest \<leadsto> mdbNext dest_node" .. finally show False by simp qed have src_dest_pn': "\<lbrakk> mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src \<rbrakk>
    \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node" proof (rule not_sym, rule) assume a: "mdbPrev dest_node = mdbNext src_node" and "mdbPrev dest_node \<noteq> 0"
      and msd: "mdbNext dest_node = src" hence a': "mdbPrev dest_node \<noteq> 0" by simp have "m \<turnstile> src \<leadsto> mdbPrev dest_node" by (rule next_fold, rule src, simp add: a) also have "m \<turnstile> mdbPrev dest_node \<leadsto> dest" using a' .. also have "m \<turnstile> dest \<leadsto> src" using dest msd by - (rule next_fold, simp+) finally show False by simp qed from domn have domm: "p \<in> dom m" by (simp add: dom_n_m) with no_0 have p0: "p \<noteq> 0" by (rule dom_into_not0) show ?thesis proof (cases rule: swap_ptr_cases [where p = p]) case p_src_prev hence psrc [intro?]: "m \<turnstile> p \<leadsto> src" using p0 by (clarsimp intro!: src_prev_next) show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = src" using p_src_prev dest src np n0 using [[hypsubst_thin = true]] apply clarsimp apply (drule n_src_prev) apply (clarsimp simp: dest_src ) done thus ?thesis using p_src_prev mmn dest_src by (simp add: dest2_node_def) next case src_dest hence "mdbNext dest_node \<noteq> mdbPrev src_node" using p_src_prev p0 by - (rule dest_src_pn, simp) hence "?mn = mdbPrev (cteMDBNode ctep)" using p_src_prev src np mp p0 dest src_dest by simp (drule n_src_prev, clarsimp) thus ?thesis using p_src_prev src_dest mmn n0 mp apply simp apply (subst n_other [OF other_src_prev_src_dest]) apply simp+ apply (erule dlistEp [OF mp, simplified]) apply simp done next case other show ?thesis proof (cases "mdbPrev src_node = mdbNext dest_node") case True thus ?thesis using p_src_prev mmn other np mp other by simp (drule n_dest_next, simp add: dest2_node_next split: if_split_asm) next let ?mn' = "mdbPrev (cteMDBNode ctep)" case False hence mnmn: "?mn = ?mn'" using p_src_prev src np mp p0 dest other by simp (drule n_src_prev, clarsimp) have mnp: "m \<turnstile> ?mn' \<leadsto> p" using mp mnmn n0 dlist by (cases ctep, auto intro!: prev_leadstoI) note superFalse = False show ?thesis proof (cases "?mn' = mdbNext dest_node") case True thus ?thesis using mmn p_src_prev superFalse n0 mp by (simp add: mnmn) (frule n_dest_next, auto elim: dlistEp simp: other [symmetric]) next case False have eq: "n ?mn' = m ?mn'" proof (rule n_other) show "?mn' \<noteq> mdbPrev dest_node" using mp other p_src_prev n0 mnmn by (cases ctep, simp add: p_prev_qe) show "?mn' \<noteq> dest" proof assume "?mn' = dest" hence "mdbNext dest_node = mdbPrev src_node" using mnp dest p_src_prev by (simp add: next_unfold') thus False using superFalse by simp qed show "?mn' \<noteq> mdbNext dest_node" by fact+ show "?mn' \<noteq> mdbPrev src_node" using mp other p_src_prev n0 mnmn by (cases ctep, simp add: p_prev_qe_src) show "?mn' \<noteq> src" using src mnp p_src_prev p0 by (clarsimp simp add: next_unfold') show "?mn' \<noteq> mdbNext src_node" proof assume a: "?mn' = mdbNext src_node" have "m \<turnstile> ?mn' \<leadsto> p" using mnp . also have "m \<turnstile> p \<leadsto> src" .. also have "m \<turnstile> src \<leadsto> mdbNext src_node" .. finally show False using a by simp qed qed thus ?thesis using mnmn mmn mp p_src_prev n0 by - (erule dlistEp [where p = p], simp+) qed qed qed next case p_src show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = dest" using p_src src dest np by (cases cte, clarsimp simp add: dest2_node_def) thus ?thesis using p_src src_dest by (simp add: n_dest) next case dest_src hence "?mn = mdbPrev dest_node" using p_src src np by (clarsimp simp: dest2_node_def) thus ?thesis using p_src mmn dest_src apply (simp add: n_dest dest2_node_prev) apply (drule n_dest_prev) apply clarsimp done next case other hence "?mn = mdbPrev dest_node" using p_src src np by (clarsimp simp add: dest2_node_def) thus ?thesis using p_src mmn other by simp (drule n_dest_prev, clarsimp) qed next case p_src_next show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = mdbPrev src_node" using p_src_next src dest np mp by (clarsimp simp: n_dest) thus ?thesis using p_src_next mmn src_dest by simp (drule n_src_prev, clarsimp) next case dest_src hence "?mn = dest" using p_src_next src np mp by simp (drule n_src_next, simp) thus ?thesis using p_src_next dest_src by (simp add: n_dest) next case other hence "?mn = dest" using p_src_next src np mp by simp (drule n_src_next, simp) thus ?thesis using p_src_next mmn other by (simp add: n_dest) qed next case p_dest_prev hence pdest [intro?]: "m \<turnstile> p \<leadsto> dest" using p0 by (clarsimp intro!: dest_prev_next) show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = dest" using p_dest_prev src dest np n0 using [[hypsubst_thin = true]] apply clarsimp apply (drule n_dest_prev) apply (clarsimp simp: src_dest ) done thus ?thesis using p_dest_prev mmn src_dest by (simp add: n_dest) next case dest_src hence "mdbNext src_node \<noteq> mdbPrev dest_node" using p_dest_prev p0 by - (rule src_dest_pn', simp) hence "?mn = mdbPrev (cteMDBNode ctep)" using p_dest_prev dest np mp p0 src dest_src by simp (drule n_dest_prev, clarsimp) thus ?thesis using p_dest_prev dest_src mmn n0 mp apply simp apply (subst n_other [OF other_dest_prev_dest_src]) apply simp+ apply (erule dlistEp [OF mp, simplified]) apply simp done next case other show ?thesis proof (cases "mdbNext src_node = mdbPrev dest_node") case True thus ?thesis using p_dest_prev mmn other np mp other by simp (drule n_dest_prev, simp add: n_dest) next let ?mn' = "mdbPrev (cteMDBNode ctep)" case False hence mnmn: "?mn = ?mn'" using p_dest_prev src np mp p0 dest other by simp (drule n_dest_prev, clarsimp) have mnp: "m \<turnstile> ?mn' \<leadsto> p" using mp mnmn n0 dlist by (cases ctep, auto intro!: prev_leadstoI) note superFalse = False show ?thesis proof (cases "?mn' = mdbNext src_node") case True thus ?thesis using mmn p_dest_prev superFalse n0 mp by (simp add: mnmn) (frule n_src_next, auto elim: dlistEp simp: other [symmetric]) next case False have eq: "n ?mn' = m ?mn'" proof (rule n_other) show "?mn' \<noteq> mdbPrev src_node" using mp other p_dest_prev n0 mnmn by (cases ctep, simp add: p_prev_qe_src) show "?mn' \<noteq> src" proof assume "?mn' = src" hence "mdbNext src_node = mdbPrev dest_node" using mnp src p_dest_prev by (simp add: next_unfold') thus False using superFalse by simp qed show "?mn' \<noteq> mdbNext src_node" by fact+ show "?mn' \<noteq> mdbPrev dest_node" using mp other p_dest_prev n0 mnmn by (cases ctep, simp add: p_prev_qe) show "?mn' \<noteq> dest" using dest mnp p_dest_prev p0 by (clarsimp simp add: next_unfold') show "?mn' \<noteq> mdbNext dest_node" proof assume a: "?mn' = mdbNext dest_node" have "m \<turnstile> ?mn' \<leadsto> p" using mnp . also have "m \<turnstile> p \<leadsto> dest" .. also have "m \<turnstile> dest \<leadsto> mdbNext dest_node" .. finally show False using a by simp qed qed thus ?thesis using mnmn mmn mp p_dest_prev n0 by - (erule dlistEp [where p = p], simp+) qed qed qed next case p_dest show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = src" using p_dest dest src np by (cases cte, clarsimp simp add: n_dest) thus ?thesis using p_dest dest_src by (simp add: dest2_node_next) next case src_dest hence "?mn = mdbPrev src_node" using p_dest dest np by (clarsimp simp: n_dest) thus ?thesis using p_dest mmn src_dest apply (simp add: n_src n_dest) apply (drule n_src_prev) apply clarsimp done next case other hence "?mn = mdbPrev src_node" using p_dest dest np by (clarsimp simp add: n_dest) thus ?thesis using p_dest mmn other by simp (drule n_src_prev, clarsimp) qed next case p_dest_next show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = mdbPrev dest_node" using p_dest_next dest src np mp by (clarsimp simp: dest2_node_def) thus ?thesis using p_dest_next mmn dest_src by simp (drule n_dest_prev, clarsimp) next case src_dest hence "?mn = src" using p_dest_next dest np mp by simp (drule n_dest_next, simp) thus ?thesis using p_dest_next src_dest by (simp add: dest2_node_def) next case other hence "?mn = src" using p_dest_next dest np mp by simp (drule n_dest_next, simp) thus ?thesis using p_dest_next mmn other by (simp add: dest2_node_def) qed next case p_other hence eq: "n p = m p" by (rule n_other) hence eq': "cte = ctep" using mp np by simp have mns: "?mn \<noteq> src" proof assume "?mn = src" hence "p = mdbNext src_node" using mp mmn src eq' n0 by (auto elim: dlistEp) thus False using p_other by simp qed have mnsn: "?mn \<noteq> mdbPrev src_node" proof assume "?mn = mdbPrev src_node" hence "src = p" using mp eq' n0 by (cases ctep, clarsimp dest!: p_prev_qe_src) thus False using p_other by simp qed have mnd: "?mn \<noteq> dest" proof assume "?mn = dest" hence "p = mdbNext dest_node" using mp mmn dest eq' n0 by (auto elim: dlistEp) thus False using p_other by simp qed have mndn: "?mn \<noteq> mdbPrev dest_node" proof assume "?mn = mdbPrev dest_node" hence "dest = p" using mp eq' n0 by (cases ctep, clarsimp dest!: p_prev_qe) thus False using p_other by simp qed from dd obtain cten where nmn: "n ?mn = Some cten" by auto have mnext: "mdbNext (cteMDBNode cte') = p" using mp mmn by - (erule dlistEp, rule dom_into_not0 [OF no_0], (clarsimp simp: eq')+) show ?thesis proof (cases rule: cases2 [of "?mn = mdbNext src_node" "?mn = mdbNext dest_node"]) case pos_pos thus ?thesis using n0 by simp next case pos_neg thus ?thesis using  mmn nmn mnd mndn by simp (drule n_src_next, simp add: mnext eq' next_dest_prev_src_sym) next case neg_pos thus ?thesis using mmn nmn mns mnsn by simp (drule n_dest_next, simp add: mnext eq' annoying_simps) next case neg_neg thus ?thesis using mmn nmn mns mnsn mnd mndn mnext by (simp add: n_other) qed qed next fix p cte assume np: "n p = Some cte" and n0: "mdbNext (cteMDBNode cte) \<noteq> 0" let ?thesis =
    "\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p" let ?mn = "mdbNext (cteMDBNode cte)" note p_next_qe_src = mdb_ptr_src.p_next_qe note annoying_simps [simp del]
    = next_dest_prev_src  next_dest_prev_src_sym prev_dest_next_src prev_dest_next_src_sym from np have domn: "p \<in> dom n" by (rule domI) then obtain ctep where mp: "m p = Some ctep" by (clarsimp simp add: dom_n_m) from n0 have dd: "mdbNext (cteMDBNode cte) \<in> dom n" using np apply - apply (erule contrapos_pp) apply (cases cte) apply (drule ndom_is_0D [OF _ cteSwap_chain no_0_n, where ptr = p]) apply simp+ done then obtain cte' where mmn: "m (mdbNext (cteMDBNode cte)) = Some cte'" by (clarsimp simp add: dom_n_m) have src_dest_pn: "\<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest \<rbrakk>
    \<Longrightarrow> mdbPrev src_node \<noteq> mdbNext dest_node" proof assume "mdbPrev src_node = mdbNext dest_node" and "mdbNext dest_node \<noteq> 0"
      and msd: "mdbNext src_node = dest" hence "m \<turnstile> mdbNext dest_node \<leadsto> src" by (auto dest!: src_prev intro: next_fold) also have "m \<turnstile> src \<leadsto> dest" using src using msd next_fold by auto also have "m \<turnstile> dest \<leadsto> mdbNext dest_node" .. finally show False by simp qed have src_dest_pn': "\<lbrakk> mdbNext src_node \<noteq> 0; mdbNext dest_node = src \<rbrakk>
    \<Longrightarrow> mdbPrev dest_node \<noteq> mdbNext src_node" proof assume a: "mdbPrev dest_node = mdbNext src_node" and "mdbNext src_node \<noteq> 0"
      and msd: "mdbNext dest_node = src" hence a': "mdbPrev dest_node \<noteq> 0" by simp have "m \<turnstile> src \<leadsto> mdbPrev dest_node" by (rule next_fold, rule src, simp add: a) also have "m \<turnstile> mdbPrev dest_node \<leadsto> dest" using a' .. also have "m \<turnstile> dest \<leadsto> src" using dest msd by - (rule next_fold, simp+) finally show False by simp qed from domn have domm: "p \<in> dom m" by (simp add: dom_n_m) with no_0 have p0: "p \<noteq> 0" by (rule dom_into_not0) from np have npp: "n \<turnstile> p \<leadsto> mdbNext (cteMDBNode cte)" by (simp add: next_fold) hence swp: "m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))" by (simp add: next_m_n) show ?thesis proof (cases rule: swap_ptr_cases [where p = p]) case p_src_prev hence p0': "mdbPrev src_node \<noteq> 0" using p0 by simp hence stp: "m \<turnstile> mdbPrev src_node \<leadsto> src" .. show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = dest" using stp np mp p_src_prev by (simp add: next_m_n s_d_swap_def  next_unfold') (drule n_src_prev, clarsimp) thus ?thesis using p_src_prev n_dest src_dest by auto next case dest_src hence "?mn = mdbNext src_node" using stp np mp p_src_prev by (clarsimp simp add: next_m_n s_d_swap_def  next_unfold' n_dest) thus ?thesis using p_src_prev mmn dest_src by simp (drule n_src_next, clarsimp) next case other hence "?mn = dest" using stp np mp p_src_prev by (clarsimp simp add: next_m_n s_d_swap_def next_unfold' annoying_simps
          dest!: n_src_prev) thus ?thesis using p_src_prev other by (simp add: n_dest) qed next case p_src show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = mdbNext dest_node" using p_src src np by (cases cte, clarsimp simp add: dest2_node_def) thus ?thesis using p_src mmn src_dest by simp (drule n_dest_next, clarsimp) next case dest_src hence "?mn = dest" using p_src src np by (cases cte, clarsimp simp add: dest2_node_def) thus ?thesis using p_src mmn dest_src by (simp add: n_dest) next case other hence "?mn = mdbNext dest_node" using p_src src np by (cases cte, clarsimp simp add: dest2_node_def) thus ?thesis using p_src mmn other by simp (drule n_dest_next, clarsimp) qed next case p_src_next show ?thesis proof (cases rule: swap_cases) case src_dest hence "?mn = src" using p_src_next dest np by (cases cte, clarsimp simp: n_dest) thus ?thesis using p_src_next mmn src_dest by (simp add: dest2_node_def) next case dest_src hence "mdbPrev dest_node \<noteq> mdbNext src_node" using p_src_next p0 by - (rule src_dest_pn', simp+) hence "?mn = mdbNext (cteMDBNode ctep)" using p_src_next src np mp p0 dest dest_src by simp (drule n_src_next, clarsimp) thus ?thesis using p_src_next dest_src mmn n0 mp apply simp apply (subst n_other [OF other_src_next_dest_src]) apply simp+ apply (erule dlistEn [OF mp, simplified]) apply simp done next case other show ?thesis proof (cases "mdbNext src_node = mdbPrev dest_node") case True thus ?thesis using p_src_next mmn other np mp other by simp (drule n_dest_prev, simp add: dest2_node_prev split: if_split_asm) next let ?mn' = "mdbNext (cteMDBNode ctep)" case False hence mnmn: "?mn = ?mn'" using p_src_next src np mp p0 dest other by simp (drule n_src_next, clarsimp) note superFalse = False show ?thesis proof (cases "?mn' = mdbPrev dest_node") case True thus ?thesis using mmn p_src_next superFalse n0 mp by (simp add: mnmn) (frule n_dest_prev, auto elim: dlistEn) next case False have eq: "n ?mn' = m ?mn'" proof (rule n_other) have "m \<turnstile> src \<leadsto> mdbNext src_node" .. hence sp [intro?]: "m \<turnstile> src \<leadsto> p" by (simp add: p_src_next) also have mmn'[intro?]: "m \<turnstile> p \<leadsto> ?mn'" using mp by (simp add: next_unfold') finally have smn [intro?]: "m \<turnstile> src \<leadsto>\<^sup>+ ?mn'" . 
              (* Sigh *)

             show "?mn' \<noteq> mdbPrev src_node" proof assume a: "?mn' = mdbPrev src_node" also have "mdbPrev src_node \<noteq> 0" using mmn by - (rule dom_into_not0 [OF no_0 domI], simp add: a [symmetric] mnmn) hence "m \<turnstile> mdbPrev src_node \<leadsto> src" .. also have "m \<turnstile> src \<leadsto>\<^sup>+ ?mn'" .. finally show False by simp qed show "?mn' \<noteq> src" using smn by clarsimp show "?mn' \<noteq> mdbNext src_node" proof assume "?mn' = mdbNext src_node" also have "mdbNext src_node = p" by (simp add: p_src_next) also have "m \<turnstile> p \<leadsto> ?mn'" .. finally show False by simp qed show "?mn' \<noteq> mdbPrev dest_node" by fact+ show "?mn' \<noteq> dest" using src mp p_src_next mnmn swp by (clarsimp simp add: next_unfold' s_d_swap_def split: if_split_asm) show "?mn' \<noteq> mdbNext dest_node" using mnmn mp p_src_next swp False superFalse other n0 by (cases ctep, clarsimp simp add: next_unfold' s_d_swap_def dest!: p_next_eq) qed thus ?thesis using mnmn mmn mp p_src_next n0 by - (erule dlistEn [where p = p], simp+) qed qed qed next case p_dest_prev hence p0': "mdbPrev dest_node \<noteq> 0" using p0 by simp hence stp: "m \<turnstile> mdbPrev dest_node \<leadsto> dest" .. show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = src" using stp np mp p_dest_prev by (simp add: next_m_n s_d_swap_def  next_unfold') (drule n_dest_prev, clarsimp) thus ?thesis using p_dest_prev dest_src by (simp add: n_src dest2_node_prev) next case src_dest hence "?mn = mdbNext dest_node" using stp np mp p_dest_prev by (simp add: annoying_simps) (drule n_dest_prev, clarsimp) thus ?thesis using p_dest_prev mmn src_dest by simp (drule n_dest_next, clarsimp) next case other hence "?mn = src" using stp np mp p_dest_prev by simp (drule n_dest_prev, simp) thus ?thesis using p_dest_prev other by (simp add: n_src dest2_node_prev) qed next case p_dest show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = mdbNext src_node" using p_dest dest src np by (cases cte, clarsimp simp add: n_dest) thus ?thesis using p_dest mmn dest_src by simp (drule n_src_next, clarsimp) next case src_dest hence "?mn = src" using p_dest dest np by (cases cte, clarsimp simp add: n_dest) thus ?thesis using p_dest mmn src_dest by (simp add: n_src dest2_node_prev) next case other hence "?mn = mdbNext src_node" using p_dest dest np by (cases cte, clarsimp simp add: n_dest) thus ?thesis using p_dest mmn other by simp (drule n_src_next, clarsimp) qed next case p_dest_next show ?thesis proof (cases rule: swap_cases) case dest_src hence "?mn = dest" using p_dest_next src np by (cases cte, clarsimp simp: n_src dest2_node_def) thus ?thesis using p_dest_next mmn dest_src by (simp add: dest2_node_def n_dest) next case src_dest hence "mdbPrev src_node \<noteq> mdbNext dest_node" using p_dest_next p0 by - (rule src_dest_pn, simp+) hence "?mn = mdbNext (cteMDBNode ctep)" using p_dest_next dest np mp p0 src src_dest by simp (drule n_dest_next, clarsimp) thus ?thesis using p_dest_next src_dest mmn n0 mp apply simp apply (subst n_other [OF other_dest_next_src_dest]) apply simp+ apply (erule dlistEn [OF mp, simplified]) apply simp done next case other show ?thesis proof (cases "mdbNext dest_node = mdbPrev src_node") case True thus ?thesis using p_dest_next mmn other np mp other by simp (drule n_src_prev, simp add: dest2_node_prev n_dest ) next let ?mn' = "mdbNext (cteMDBNode ctep)" case False hence mnmn: "?mn = ?mn'" using p_dest_next src np mp p0 dest other by simp (drule n_dest_next, clarsimp) note superFalse = False show ?thesis proof (cases "?mn' = mdbPrev src_node") case True thus ?thesis using mmn p_dest_next superFalse n0 mp by (simp add: mnmn) (frule n_src_prev, auto elim: dlistEn) next case False have eq: "n ?mn' = m ?mn'" proof (rule n_other) have "m \<turnstile> dest \<leadsto> mdbNext dest_node" .. hence sp [intro?]: "m \<turnstile> dest \<leadsto> p" by (simp add: p_dest_next) also have mmn'[intro?]: "m \<turnstile> p \<leadsto> ?mn'" using mp by (simp add: next_unfold') finally have smn [intro?]: "m \<turnstile> dest \<leadsto>\<^sup>+ ?mn'" . 
              (* Sigh *)

             show "?mn' \<noteq> mdbPrev dest_node" proof assume a: "?mn' = mdbPrev dest_node" also have "mdbPrev dest_node \<noteq> 0" using mmn by - (rule dom_into_not0 [OF no_0 domI], simp add: a [symmetric] mnmn) hence "m \<turnstile> mdbPrev dest_node \<leadsto> dest" .. also have "m \<turnstile> dest \<leadsto>\<^sup>+ ?mn'" .. finally show False by simp qed show "?mn' \<noteq> dest" using smn by clarsimp show "?mn' \<noteq> mdbNext dest_node" proof assume "?mn' = mdbNext dest_node" also have "mdbNext dest_node = p" by (simp add: p_dest_next) also have "m \<turnstile> p \<leadsto> ?mn'" .. finally show False by simp qed show "?mn' \<noteq> mdbPrev src_node" by fact+ show "?mn' \<noteq> src" using dest mp p_dest_next mnmn swp by (clarsimp simp add: next_unfold' s_d_swap_def split: if_split_asm) show "?mn' \<noteq> mdbNext src_node" using mnmn mp p_dest_next swp False superFalse other n0 by (cases ctep, clarsimp simp add: next_unfold' s_d_swap_def
                dest!: p_next_qe_src) qed thus ?thesis using mnmn mmn mp p_dest_next n0 by - (erule dlistEn [where p = p], simp+) qed qed qed next case p_other hence eq: "n p = m p" by (rule n_other) hence eq': "cte = ctep" using mp np by simp have mns: "?mn \<noteq> src" proof assume "?mn = src" hence "p = mdbPrev src_node" using mp mmn src eq' n0 by (auto elim: dlistEn) thus False using p_other by simp qed have mnsn: "?mn \<noteq> mdbNext src_node" proof assume "?mn = mdbNext src_node" hence "src = p" using mp eq' n0 by (cases ctep, clarsimp dest!: p_next_qe_src) thus False using p_other by simp qed have mnd: "?mn \<noteq> dest" proof assume "?mn = dest" hence "p = mdbPrev dest_node" using mp mmn dest eq' n0 by (auto elim: dlistEn) thus False using p_other by simp qed have mndn: "?mn \<noteq> mdbNext dest_node" proof assume "?mn = mdbNext dest_node" hence "dest = p" using mp eq' n0 by (cases ctep, clarsimp dest!: p_next_qe) thus False using p_other by simp qed from dd obtain cten where nmn: "n ?mn = Some cten" by auto have mprev: "mdbPrev (cteMDBNode cte') = p" using mp mmn by - (erule dlistEn, rule dom_into_not0 [OF no_0], (clarsimp simp: eq')+) show ?thesis proof (cases rule: cases2 [of "?mn = mdbPrev src_node" "?mn = mdbPrev dest_node"]) case pos_pos thus ?thesis using n0 by simp next case pos_neg thus ?thesis using  mmn nmn mnd mndn by simp (drule n_src_prev, simp add: mprev eq' next_dest_prev_src_sym) next case neg_pos thus ?thesis using mmn nmn mns mnsn by simp (drule n_dest_prev, simp add: mprev eq' annoying_simps) next case neg_neg thus ?thesis using mmn nmn mns mnsn mnd mndn mprev by (simp add: n_other) qed qed qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. valid_dlist n proof (state)
goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
n p = Some cte
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
m ?p' = Some (CTE ?cap' ?node') \<Longrightarrow> (mdbPrev ?node' = mdbPrev src_node) = (src = ?p' \<or> mdbPrev src_node = 0 \<and> mdbPrev ?node' = 0)

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
(mdbNext dest_node = src) = (mdbPrev src_node = dest)
(src = mdbNext dest_node) = (mdbPrev src_node = dest)
(mdbPrev dest_node = src) = (mdbNext src_node = dest)
(src = mdbPrev dest_node) = (mdbNext src_node = dest)

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
(?w \<noteq> 0) = (0 < ?w)

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
n p = Some cte proof (prove)
using this:
n p = Some cte

goal (1 subgoal):
 1. p \<in> dom n proof (state)
this:
p \<in> dom n

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
p \<in> dom n proof (prove)
using this:
p \<in> dom n

goal (1 subgoal):
 1. (\<And>ctep. m p = Some ctep \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m p = Some ctep

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) \<in> dom n proof (state)
this:
mdbPrev (cteMDBNode cte) \<in> dom n

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
mdbPrev (cteMDBNode cte) \<in> dom n proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<in> dom n

goal (1 subgoal):
 1. (\<And>cte'. m (mdbPrev (cteMDBNode cte)) = Some cte' \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m (mdbPrev (cteMDBNode cte)) = Some cte'

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
mdbPrev src_node = mdbNext dest_node
mdbPrev src_node \<noteq> 0
mdbNext src_node = dest

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
mdbPrev src_node = mdbNext dest_node
mdbPrev src_node \<noteq> 0
mdbNext src_node = dest

goal (1 subgoal):
 1. m \<turnstile> mdbNext dest_node \<leadsto> src proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> dest proof (prove)
using this:
m src = Some (CTE src_cap src_node)
\<lbrakk>?m ?a = Some ?cte; mdbNext (cteMDBNode ?cte) = ?b\<rbrakk> \<Longrightarrow> ?m \<turnstile> ?a \<leadsto> ?b
mdbNext src_node = dest

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> dest proof (state)
this:
m \<turnstile> src \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> src \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbNext dest_node proof (prove)
using this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
\<lbrakk>mdbPrev src_node \<noteq> 0; mdbNext src_node = dest\<rbrakk> \<Longrightarrow> mdbNext dest_node \<noteq> mdbPrev src_node

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
mdbPrev dest_node = mdbNext src_node
mdbPrev dest_node \<noteq> 0
mdbNext dest_node = src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
mdbPrev dest_node = mdbNext src_node
mdbPrev dest_node \<noteq> 0
mdbNext dest_node = src

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> mdbPrev dest_node proof (state)
this:
m \<turnstile> src \<leadsto> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> src \<leadsto> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> src proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
mdbNext dest_node = src

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> src proof (state)
this:
m \<turnstile> dest \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> src \<leadsto>\<^sup>+ src proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
\<lbrakk>mdbPrev dest_node \<noteq> 0; mdbNext dest_node = src\<rbrakk> \<Longrightarrow> mdbNext src_node \<noteq> mdbPrev dest_node

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
p \<in> dom n proof (prove)
using this:
p \<in> dom n

goal (1 subgoal):
 1. p \<in> dom m proof (state)
this:
p \<in> dom m

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
no_0 m
p \<in> dom m proof (prove)
using this:
no_0 m
p \<in> dom m

goal (1 subgoal):
 1. p \<noteq> 0 proof (state)
this:
p \<noteq> 0

goal (2 subgoals):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = mdbPrev src_node

goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
p = mdbPrev src_node

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> src proof (prove)
using this:
p = mdbPrev src_node
p \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> src proof (state)
this:
m \<turnstile> p \<leadsto> src

goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbPrev src_node
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
n p = Some cte
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbPrev src_node
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
n p = Some cte
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; mdbPrev dest_node = 0 \<longrightarrow> mdbNext dest_node \<noteq> 0; m (mdbPrev src_node) = Some (CTE dest_cap dest_node); m (mdbNext dest_node) = Some (CTE src_cap src_node); n (mdbPrev src_node) = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte) = mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; mdbPrev dest_node = 0 \<longrightarrow> mdbNext dest_node \<noteq> 0; m (mdbNext dest_node) = Some (CTE src_cap src_node); n (mdbPrev src_node) = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0; \<exists>cte'. n (mdbPrev src_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = (if src = mdbNext dest_node then mdbNext src_node else dest) \<and> mdbPrev (cteMDBNode cte') = (if mdbNext dest_node = mdbPrev src_node \<or> src = mdbNext dest_node then src else mdbPrev (cteMDBNode (CTE dest_cap dest_node)))\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte) = mdbNext dest_node proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) = src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src
p = mdbPrev src_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev src_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node proof (state)
this:
mdbNext dest_node \<noteq> mdbPrev src_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (prove)
using this:
mdbNext dest_node \<noteq> mdbPrev src_node
p = mdbPrev src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
p = mdbPrev src_node
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbPrev (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode ctep)) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node proof (prove)
goal (4 subgoals):
 1. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext src_node = dest
 2. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> m (mdbPrev src_node) = Some ctep
 3. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode ctep) \<noteq> 0
 4. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. m (mdbPrev (cteMDBNode ctep)) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte') = mdbPrev src_node proof (prove)
goal (1 subgoal):
 1. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev src_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbPrev (cteMDBNode ctep)) = Some cte'; m (mdbPrev src_node) = Some ctep; m (mdbPrev (cteMDBNode ctep)) = Some cte'a; mdbNext (cteMDBNode cte'a) = p\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte') = mdbPrev src_node proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbPrev src_node = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev src_node = mdbNext dest_node

goal (2 subgoals):
 1. mdbPrev src_node = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev src_node = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev src_node = mdbNext dest_node
p = mdbPrev src_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
n p = Some cte
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (prove)
using this:
mdbPrev src_node \<noteq> mdbNext dest_node
p = mdbPrev src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (prove)
using this:
m p = Some ctep
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
mdbPrev (cteMDBNode cte) \<noteq> 0
valid_dlist m

goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode ctep) = mdbNext dest_node

goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
p = mdbPrev src_node
mdbPrev src_node \<noteq> mdbNext dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep)) proof (state)
goal (6 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> src
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbPrev (cteMDBNode ctep) \<noteq> dest
 6. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (prove)
using this:
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev src_node
mdbPrev (cteMDBNode cte) \<noteq> 0
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node

goal (5 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> src
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbPrev (cteMDBNode ctep) \<noteq> dest
 5. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> dest proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = dest \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode ctep) = dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = dest \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = dest

goal (1 subgoal):
 1. mdbNext dest_node = mdbPrev src_node proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = dest
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p
m dest = Some (CTE dest_cap dest_node)
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext dest_node = mdbPrev src_node proof (state)
this:
mdbNext dest_node = mdbPrev src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = dest \<Longrightarrow> False proof (prove)
using this:
mdbNext dest_node = mdbPrev src_node

goal (1 subgoal):
 1. False proof (prove)
using this:
mdbNext dest_node = mdbPrev src_node
mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> dest

goal (4 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> src
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node

goal (3 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> src
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (prove)
using this:
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev src_node
mdbPrev (cteMDBNode cte) \<noteq> 0
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node

goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> src
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> src proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p
p = mdbPrev src_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> src proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode ctep) = mdbNext src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> src proof (state)
this:
m \<turnstile> p \<leadsto> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> p \<leadsto> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> mdbNext src_node proof (state)
this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext src_node proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext src_node

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext src_node
mdbPrev (cteMDBNode ctep) = mdbNext src_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node

goal:
No subgoals! proof (state)
this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
m (mdbPrev (cteMDBNode cte)) = Some cte'
m p = Some ctep
p = mdbPrev src_node
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = src

goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = src
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (state)
this:
mdbPrev (cteMDBNode cte) = dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest
p = src
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = src
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node
p = src
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev dest_node; p = src; m (mdbPrev dest_node) = Some cte'; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev dest_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = src proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev dest_node; p = src; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; \<exists>cte'a. n (mdbPrev dest_node) = Some cte'a \<and> mdbNext (cteMDBNode cte'a) = (if dest = mdbNext src_node then mdbNext dest_node else src) \<and> mdbPrev (cteMDBNode cte'a) = (if mdbNext src_node = mdbPrev dest_node \<or> dest = mdbNext src_node then dest else mdbPrev (cteMDBNode cte'))\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev dest_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = src proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = src
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node
p = src
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = mdbNext src_node

goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext src_node
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node
p = mdbNext src_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbNext src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (state)
this:
mdbPrev (cteMDBNode cte) = dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest
p = mdbNext src_node
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (state)
this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest
p = mdbNext src_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = mdbPrev dest_node

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
p = mdbPrev dest_node

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> dest proof (prove)
using this:
p = mdbPrev dest_node
p \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> dest proof (state)
this:
m \<turnstile> p \<leadsto> dest

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev dest_node
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev dest_node
m src = Some (CTE src_cap src_node)
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node = 0 \<longrightarrow> mdbNext dest_node \<noteq> 0; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbPrev dest_node) = Some (CTE src_cap src_node); m (mdbNext src_node) = Some (CTE dest_cap dest_node); mdbPrev (mdb_swap.dest2_node src_node (mdbNext src_node) dest_node) \<noteq> 0\<rbrakk> \<Longrightarrow> mdbPrev (mdb_swap.dest2_node src_node (mdbNext src_node) dest_node) = mdbNext src_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev dest_node = 0 \<longrightarrow> mdbNext dest_node \<noteq> 0; mdbPrev src_node = 0 \<longrightarrow> mdbNext src_node \<noteq> 0; m (mdbNext src_node) = Some (CTE dest_cap dest_node); mdbPrev (mdb_swap.dest2_node src_node (mdbNext src_node) dest_node) \<noteq> 0; \<exists>cte'. n (mdbPrev dest_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = (if dest = mdbNext src_node then mdbNext dest_node else src) \<and> mdbPrev (cteMDBNode cte') = (if mdbNext src_node = mdbPrev dest_node \<or> dest = mdbNext src_node then dest else mdbPrev (cteMDBNode (CTE src_cap src_node)))\<rbrakk> \<Longrightarrow> mdbPrev (mdb_swap.dest2_node src_node (mdbNext src_node) dest_node) = mdbNext src_node proof (prove)
goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) = dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest
p = mdbPrev dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbPrev dest_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node proof (state)
this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node
p = mdbPrev dest_node
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m src = Some (CTE src_cap src_node)
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
p = mdbPrev dest_node
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbPrev (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode ctep)) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev dest_node proof (prove)
goal (4 subgoals):
 1. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext dest_node = src
 2. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> m (mdbPrev dest_node) = Some ctep
 3. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode ctep) \<noteq> 0
 4. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. m (mdbPrev (cteMDBNode ctep)) = Some cte' \<and> mdbNext (cteMDBNode cte') = mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; mdbPrev (cteMDBNode ctep) \<noteq> 0; m (mdbPrev dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte') = mdbPrev dest_node proof (prove)
goal (1 subgoal):
 1. \<And>cte'a. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep); p = mdbPrev dest_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbPrev (cteMDBNode ctep)) = Some cte'; m (mdbPrev dest_node) = Some ctep; m (mdbPrev (cteMDBNode ctep)) = Some cte'a; mdbNext (cteMDBNode cte'a) = p\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte') = mdbPrev dest_node proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbNext src_node = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = mdbPrev dest_node

goal (2 subgoals):
 1. mdbNext src_node = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node
p = mdbPrev dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
n p = Some cte
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node
p = mdbPrev dest_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep) proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (prove)
using this:
m p = Some ctep
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
mdbPrev (cteMDBNode cte) \<noteq> 0
valid_dlist m

goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode ctep) = mdbNext src_node

goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = mdbNext src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = mdbNext src_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
p = mdbPrev dest_node
mdbNext src_node \<noteq> mdbPrev dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep)) proof (state)
goal (6 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> src
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbPrev (cteMDBNode ctep) \<noteq> dest
 6. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (prove)
using this:
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev src_node

goal (5 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> src
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 4. mdbPrev (cteMDBNode ctep) \<noteq> dest
 5. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> src proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = src \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode ctep) = src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = src \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = src

goal (1 subgoal):
 1. mdbNext src_node = mdbPrev dest_node proof (prove)
using this:
mdbPrev (cteMDBNode ctep) = src
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p
m src = Some (CTE src_cap src_node)
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext src_node = mdbPrev dest_node proof (state)
this:
mdbNext src_node = mdbPrev dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = src \<Longrightarrow> False proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node

goal (1 subgoal):
 1. False proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> src

goal (4 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 3. mdbPrev (cteMDBNode ctep) \<noteq> dest
 4. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node

goal (3 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 2. mdbPrev (cteMDBNode ctep) \<noteq> dest
 3. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (prove)
using this:
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbPrev dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbPrev dest_node

goal (2 subgoals):
 1. mdbPrev (cteMDBNode ctep) \<noteq> dest
 2. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> dest proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p
p = mdbPrev dest_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> dest proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode ctep) = mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto> p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> dest proof (state)
this:
m \<turnstile> p \<leadsto> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> p \<leadsto> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext dest_node proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext dest_node

goal (1 subgoal):
 1. False proof (prove)
using this:
m \<turnstile> mdbPrev (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext dest_node
mdbPrev (cteMDBNode ctep) = mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode ctep) \<noteq> mdbNext dest_node

goal:
No subgoals! proof (state)
this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))

goal (1 subgoal):
 1. mdbPrev (cteMDBNode ctep) \<noteq> mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
n (mdbPrev (cteMDBNode ctep)) = m (mdbPrev (cteMDBNode ctep))
mdbPrev (cteMDBNode cte) = mdbPrev (cteMDBNode ctep)
m (mdbPrev (cteMDBNode cte)) = Some cte'
m p = Some ctep
p = mdbPrev dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = dest

goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = dest
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (state)
this:
mdbPrev (cteMDBNode cte) = src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src
p = dest
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = dest
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node
p = dest
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev src_node; p = dest; m (mdbPrev src_node) = Some cte'; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev src_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = dest proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbPrev src_node; p = dest; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; \<exists>cte'a. n (mdbPrev src_node) = Some cte'a \<and> mdbNext (cteMDBNode cte'a) = (if src = mdbNext dest_node then mdbNext src_node else dest) \<and> mdbPrev (cteMDBNode cte'a) = (if mdbNext dest_node = mdbPrev src_node \<or> src = mdbNext dest_node then src else mdbPrev (cteMDBNode cte'))\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev src_node) = Some cte' \<and> mdbNext (cteMDBNode cte') = dest proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = dest
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node
p = dest
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p = mdbNext dest_node

goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbNext dest_node
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node
p = mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext dest_node
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (state)
this:
mdbPrev (cteMDBNode cte) = src

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src
p = mdbNext dest_node
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext dest_node
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
m p = Some ctep

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src proof (state)
this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src
p = mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. n p = m p proof (state)
this:
n p = m p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
n p = m p

goal (1 subgoal):
 1. cte = ctep proof (prove)
using this:
n p = m p
m p = Some ctep
n p = Some cte

goal (1 subgoal):
 1. cte = ctep proof (state)
this:
cte = ctep

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) \<noteq> src proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src

goal (1 subgoal):
 1. p = mdbNext src_node proof (prove)
using this:
mdbPrev (cteMDBNode cte) = src
m p = Some ctep
m (mdbPrev (cteMDBNode cte)) = Some cte'
m src = Some (CTE src_cap src_node)
cte = ctep
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. p = mdbNext src_node proof (state)
this:
p = mdbNext src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = src \<Longrightarrow> False proof (prove)
using this:
p = mdbNext src_node

goal (1 subgoal):
 1. False proof (prove)
using this:
p = mdbNext src_node
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> src

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node

goal (1 subgoal):
 1. src = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev src_node
m p = Some ctep
cte = ctep
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. src = p proof (state)
this:
src = p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
src = p

goal (1 subgoal):
 1. False proof (prove)
using this:
src = p
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) \<noteq> dest proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest

goal (1 subgoal):
 1. p = mdbNext dest_node proof (prove)
using this:
mdbPrev (cteMDBNode cte) = dest
m p = Some ctep
m (mdbPrev (cteMDBNode cte)) = Some cte'
m dest = Some (CTE dest_cap dest_node)
cte = ctep
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. p = mdbNext dest_node proof (state)
this:
p = mdbNext dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = dest \<Longrightarrow> False proof (prove)
using this:
p = mdbNext dest_node

goal (1 subgoal):
 1. False proof (prove)
using this:
p = mdbNext dest_node
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) \<noteq> mdbPrev dest_node proof (state)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. dest = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbPrev dest_node
m p = Some ctep
cte = ctep
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. dest = p proof (state)
this:
dest = p

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte) = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
dest = p

goal (1 subgoal):
 1. False proof (prove)
using this:
dest = p
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (chain)
picking this:
mdbPrev (cteMDBNode cte) \<in> dom n proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<in> dom n

goal (1 subgoal):
 1. (\<And>cten. n (mdbPrev (cteMDBNode cte)) = Some cten \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
n (mdbPrev (cteMDBNode cte)) = Some cten

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte') = p proof (prove)
using this:
m p = Some ctep
m (mdbPrev (cteMDBNode cte)) = Some cte'

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (4 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node

goal (4 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 4. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node
mdbPrev (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (3 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (3 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) = mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 3. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) = mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
n (mdbPrev (cteMDBNode cte)) = Some cten
mdbPrev (cteMDBNode cte) \<noteq> dest
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) = mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p
 2. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) = mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
n (mdbPrev (cteMDBNode cte)) = Some cten
mdbPrev (cteMDBNode cte) \<noteq> src
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node; mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev (cteMDBNode cte) \<noteq> mdbNext src_node
mdbPrev (cteMDBNode cte) \<noteq> mdbNext dest_node
m (mdbPrev (cteMDBNode cte)) = Some cte'
n (mdbPrev (cteMDBNode cte)) = Some cten
mdbPrev (cteMDBNode cte) \<noteq> src
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbPrev (cteMDBNode cte) \<noteq> dest
mdbPrev (cteMDBNode cte) \<noteq> mdbPrev dest_node
mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
n p = Some cte
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
m ?p' = Some (CTE ?cap' ?node') \<Longrightarrow> (mdbNext ?node' = mdbNext src_node) = (src = ?p' \<or> mdbNext src_node = 0 \<and> mdbNext ?node' = 0)

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
(mdbNext dest_node = src) = (mdbPrev src_node = dest)
(src = mdbNext dest_node) = (mdbPrev src_node = dest)
(mdbPrev dest_node = src) = (mdbNext src_node = dest)
(src = mdbPrev dest_node) = (mdbNext src_node = dest)

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
n p = Some cte proof (prove)
using this:
n p = Some cte

goal (1 subgoal):
 1. p \<in> dom n proof (state)
this:
p \<in> dom n

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
p \<in> dom n proof (prove)
using this:
p \<in> dom n

goal (1 subgoal):
 1. (\<And>ctep. m p = Some ctep \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m p = Some ctep

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
mdbNext (cteMDBNode cte) \<noteq> 0 proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<in> dom n proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> 0
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<in> dom n proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> 0; n p = Some cte\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode cte) \<in> dom n proof (prove)
goal (1 subgoal):
 1. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<notin> dom n\<rbrakk> \<Longrightarrow> \<not> mdbNext (cteMDBNode cte) \<noteq> 0 proof (prove)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<notin> dom n; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> \<not> mdbNext (cteMDBNode cte) \<noteq> 0 proof (prove)
goal (2 subgoals):
 1. \<And>x1 x2. \<lbrakk>n p = Some cte; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> n p = Some (CTE (?cap5 x1 x2) (cteMDBNode cte))
 2. \<And>x1 x2. \<lbrakk>n p = Some cte; cte = CTE x1 x2; mdbNext (cteMDBNode cte) = 0\<rbrakk> \<Longrightarrow> \<not> mdbNext (cteMDBNode cte) \<noteq> 0 proof (prove)
goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode cte) \<in> dom n

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
mdbNext (cteMDBNode cte) \<in> dom n proof (prove)
using this:
mdbNext (cteMDBNode cte) \<in> dom n

goal (1 subgoal):
 1. (\<And>cte'. m (mdbNext (cteMDBNode cte)) = Some cte' \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
m (mdbNext (cteMDBNode cte)) = Some cte'

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> mdbNext dest_node proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
mdbPrev src_node = mdbNext dest_node
mdbNext dest_node \<noteq> 0
mdbNext src_node = dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
mdbPrev src_node = mdbNext dest_node
mdbNext dest_node \<noteq> 0
mdbNext src_node = dest

goal (1 subgoal):
 1. m \<turnstile> mdbNext dest_node \<leadsto> src proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbNext dest_node \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> dest proof (prove)
using this:
m src = Some (CTE src_cap src_node)

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> dest proof (prove)
using this:
m src = Some (CTE src_cap src_node)
mdbNext src_node = dest
\<lbrakk>?m ?a = Some ?cte; mdbNext (cteMDBNode ?cte) = ?b\<rbrakk> \<Longrightarrow> ?m \<turnstile> ?a \<leadsto> ?b

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> dest proof (state)
this:
m \<turnstile> src \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> src \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest; mdbPrev src_node = mdbNext dest_node\<rbrakk> \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbNext dest_node proof (prove)
using this:
m \<turnstile> mdbNext dest_node \<leadsto>\<^sup>+ mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
\<lbrakk>mdbNext dest_node \<noteq> 0; mdbNext src_node = dest\<rbrakk> \<Longrightarrow> mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src\<rbrakk> \<Longrightarrow> mdbPrev dest_node \<noteq> mdbNext src_node proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
mdbPrev dest_node = mdbNext src_node
mdbNext src_node \<noteq> 0
mdbNext dest_node = src

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
using this:
mdbPrev dest_node = mdbNext src_node
mdbNext src_node \<noteq> 0
mdbNext dest_node = src

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> mdbPrev dest_node proof (state)
this:
m \<turnstile> src \<leadsto> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> src \<leadsto> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (prove)
using this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> src proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
mdbNext dest_node = src

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> src proof (state)
this:
m \<turnstile> dest \<leadsto> src

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src; mdbPrev dest_node = mdbNext src_node\<rbrakk> \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> src \<leadsto>\<^sup>+ src proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ src

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
\<lbrakk>mdbNext src_node \<noteq> 0; mdbNext dest_node = src\<rbrakk> \<Longrightarrow> mdbPrev dest_node \<noteq> mdbNext src_node

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
p \<in> dom n proof (prove)
using this:
p \<in> dom n

goal (1 subgoal):
 1. p \<in> dom m proof (state)
this:
p \<in> dom m

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
no_0 m
p \<in> dom m proof (prove)
using this:
no_0 m
p \<in> dom m

goal (1 subgoal):
 1. p \<noteq> 0 proof (state)
this:
p \<noteq> 0

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
n p = Some cte proof (prove)
using this:
n p = Some cte

goal (1 subgoal):
 1. n \<turnstile> p \<leadsto> mdbNext (cteMDBNode cte) proof (state)
this:
n \<turnstile> p \<leadsto> mdbNext (cteMDBNode cte)

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n \<turnstile> p \<leadsto> mdbNext (cteMDBNode cte)

goal (1 subgoal):
 1. m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte)) proof (state)
this:
m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))

goal (1 subgoal):
 1. \<And>p cte. \<lbrakk>n p = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = mdbPrev src_node

goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (prove)
using this:
p = mdbPrev src_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (state)
this:
mdbPrev src_node \<noteq> 0

goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (7 subgoals):
 1. p = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 7. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m \<turnstile> mdbPrev src_node \<leadsto> src
n p = Some cte
m p = Some ctep
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (state)
this:
mdbNext (cteMDBNode cte) = dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest
p = mdbPrev src_node
n dest = Some (CTE scap (MDB (if mdbNext src_node = dest then src else mdbNext src_node) (if mdbPrev src_node = dest then src else mdbPrev src_node) (mdbRevocable src_node) (mdbFirstBadged src_node)))
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
m \<turnstile> mdbPrev src_node \<leadsto> src
n p = Some cte
m p = Some ctep
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node
p = mdbPrev src_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m \<turnstile> mdbPrev src_node \<leadsto> src
n p = Some cte
m p = Some ctep
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (state)
this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest
p = mdbPrev src_node
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = src

goal (6 subgoals):
 1. p = src \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 6. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = src
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node
p = src
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = src
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (state)
this:
mdbNext (cteMDBNode cte) = dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest
p = src
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = src
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node
p = src
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = mdbNext src_node

goal (5 subgoals):
 1. p = mdbNext src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 5. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext src_node
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (state)
this:
mdbNext (cteMDBNode cte) = src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src
p = mdbNext src_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> mdbNext src_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbNext src_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> mdbNext src_node proof (state)
this:
mdbPrev dest_node \<noteq> mdbNext src_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev dest_node \<noteq> mdbNext src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (prove)
using this:
mdbPrev dest_node \<noteq> mdbNext src_node
p = mdbNext src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (2 subgoals):
 1. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
p = mdbNext src_node
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode ctep)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node proof (prove)
goal (4 subgoals):
 1. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext dest_node = src
 2. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> m (mdbNext src_node) = Some ctep
 3. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctep) \<noteq> 0
 4. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. m (mdbNext (cteMDBNode ctep)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext src_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext src_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte') = mdbNext src_node proof (prove)
goal (1 subgoal):
 1. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext src_node; mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; m (mdbNext (cteMDBNode ctep)) = Some cte'; m (mdbNext src_node) = Some ctep; m (mdbNext (cteMDBNode ctep)) = Some cte'a; mdbPrev (cteMDBNode cte'a) = p\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte') = mdbNext src_node proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbNext src_node = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = mdbPrev dest_node

goal (2 subgoals):
 1. mdbNext src_node = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = mdbPrev dest_node
p = mdbNext src_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
n p = Some cte
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (prove)
using this:
mdbNext src_node \<noteq> mdbPrev dest_node
p = mdbNext src_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext src_node \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev dest_node

goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode ctep) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode ctep) = mdbPrev dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
p = mdbNext src_node
mdbNext src_node \<noteq> mdbPrev dest_node
mdbNext (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep)) proof (state)
goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> mdbNext src_node proof (state)
this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
using this:
m \<turnstile> src \<leadsto> mdbNext src_node

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto> p proof (state)
this:
m \<turnstile> src \<leadsto> p

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
m \<turnstile> src \<leadsto> p

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (prove)
using this:
m p = Some ctep

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (chain)
picking this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (prove)
using this:
m (mdbNext (cteMDBNode cte)) = Some cte'

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> 0 proof (state)
this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (prove)
using this:
mdbPrev src_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev src_node \<leadsto> src proof (state)
this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev src_node \<leadsto> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node

goal (5 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> src
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 4. mdbNext (cteMDBNode ctep) \<noteq> dest
 5. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> src proof (prove)
using this:
m \<turnstile> src \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> src proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> src

goal (4 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 3. mdbNext (cteMDBNode ctep) \<noteq> dest
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbNext src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbNext src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. mdbNext src_node = p proof (state)
this:
mdbNext src_node = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
mdbNext src_node = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext src_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto> mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto> mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node

goal (3 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 2. mdbNext (cteMDBNode ctep) \<noteq> dest
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node

goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> dest
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> dest proof (prove)
using this:
m src = Some (CTE src_cap src_node)
m p = Some ctep
p = mdbNext src_node
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> dest proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m p = Some ctep
p = mdbNext src_node
m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
mdbNext src_node \<noteq> mdbPrev dest_node
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node

goal:
No subgoals! proof (state)
this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m (mdbNext (cteMDBNode cte)) = Some cte'
m p = Some ctep
p = mdbNext src_node
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = mdbPrev dest_node

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (prove)
using this:
p = mdbPrev dest_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (4 subgoals):
 1. p = mdbPrev dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
m \<turnstile> mdbPrev dest_node \<leadsto> dest
n p = Some cte
m p = Some ctep
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (state)
this:
mdbNext (cteMDBNode cte) = src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src
p = mdbPrev dest_node
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m \<turnstile> mdbPrev dest_node \<leadsto> dest
n p = Some cte
m p = Some ctep
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node
p = mdbPrev dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m \<turnstile> mdbPrev dest_node \<leadsto> dest
n p = Some cte
m p = Some ctep
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (state)
this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src
p = mdbPrev dest_node
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = dest

goal (3 subgoals):
 1. p = dest \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = dest
m dest = Some (CTE dest_cap dest_node)
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node
p = dest
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = dest
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src proof (state)
this:
mdbNext (cteMDBNode cte) = src

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = src
p = dest
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (prove)
using this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = dest
m dest = Some (CTE dest_cap dest_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node
p = dest
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p = mdbNext dest_node

goal (2 subgoals):
 1. p = mdbNext dest_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (prove)
using this:
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
p = mdbNext dest_node
m src = Some (CTE src_cap src_node)
n p = Some cte

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest proof (state)
this:
mdbNext (cteMDBNode cte) = dest

goal (3 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext dest_node = src; mdbPrev src_node = dest; mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest
p = mdbNext dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext dest_node = src
mdbPrev src_node = dest
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node proof (prove)
using this:
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
p = mdbNext dest_node
p \<noteq> 0

goal (1 subgoal):
 1. mdbPrev src_node \<noteq> mdbNext dest_node proof (state)
this:
mdbPrev src_node \<noteq> mdbNext dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbPrev src_node \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (prove)
using this:
mdbPrev src_node \<noteq> mdbNext dest_node
p = mdbNext dest_node
m dest = Some (CTE dest_cap dest_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m src = Some (CTE src_cap src_node)
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (2 subgoals):
 1. \<lbrakk>mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
p = mdbNext dest_node
mdbNext src_node = dest
mdbPrev dest_node = src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode ctep)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext dest_node proof (prove)
goal (4 subgoals):
 1. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext src_node = dest
 2. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> m (mdbNext dest_node) = Some ctep
 3. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode ctep) \<noteq> 0
 4. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> \<exists>cte'. m (mdbNext (cteMDBNode ctep)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; mdbNext (cteMDBNode ctep) \<noteq> 0; m (mdbNext dest_node) = Some ctep\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte') = mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. \<And>cte'a. \<lbrakk>mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep); p = mdbNext dest_node; mdbNext src_node = dest; mdbPrev dest_node = src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest; m (mdbNext (cteMDBNode ctep)) = Some cte'; m (mdbNext dest_node) = Some ctep; m (mdbNext (cteMDBNode ctep)) = Some cte'a; mdbPrev (cteMDBNode cte'a) = p\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode cte') = mdbNext dest_node proof (prove)
goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>mdbNext src_node \<noteq> dest; mdbPrev dest_node \<noteq> src; mdbNext dest_node \<noteq> src; mdbPrev src_node \<noteq> dest\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbNext dest_node = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node = mdbPrev src_node

goal (2 subgoals):
 1. mdbNext dest_node = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node = mdbPrev src_node
p = mdbNext dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
n p = Some cte
m p = Some ctep
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext dest_node \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (prove)
using this:
mdbNext dest_node \<noteq> mdbPrev src_node
p = mdbNext dest_node
m src = Some (CTE src_cap src_node)
n p = Some cte
m p = Some ctep
p \<noteq> 0
m dest = Some (CTE dest_cap dest_node)
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep) proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext dest_node \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdbNext dest_node \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev src_node

goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) = mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode ctep) = mdbPrev src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode ctep) = mdbPrev src_node
m (mdbNext (cteMDBNode cte)) = Some cte'
p = mdbNext dest_node
mdbNext dest_node \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> 0
m p = Some ctep

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep)) proof (state)
goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
using this:
m \<turnstile> dest \<leadsto> mdbNext dest_node

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto> p proof (state)
this:
m \<turnstile> dest \<leadsto> p

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto> p

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (prove)
using this:
m p = Some ctep

goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (chain)
picking this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (6 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node
 5. mdbNext (cteMDBNode ctep) \<noteq> dest
 6. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (prove)
using this:
m (mdbNext (cteMDBNode cte)) = Some cte'

goal (1 subgoal):
 1. mdbPrev dest_node \<noteq> 0 proof (state)
this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (prove)
using this:
mdbPrev dest_node \<noteq> 0

goal (1 subgoal):
 1. m \<turnstile> mdbPrev dest_node \<leadsto> dest proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (state)
this:
m \<turnstile> mdbPrev dest_node \<leadsto> dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbPrev dest_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev dest_node

goal (5 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> dest
 5. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> dest proof (prove)
using this:
m \<turnstile> dest \<leadsto>\<^sup>+ mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> dest proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> dest

goal (4 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node
 4. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbNext dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode ctep) = mdbNext dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. mdbNext dest_node = p proof (state)
this:
mdbNext dest_node = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
mdbNext dest_node = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep) proof (state)
this:
m \<turnstile> p \<leadsto> mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) = mdbNext dest_node \<Longrightarrow> False proof (chain)
picking this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto> mdbNext (cteMDBNode ctep) proof (prove)
using this:
m \<turnstile> mdbNext (cteMDBNode ctep) \<leadsto> mdbNext (cteMDBNode ctep)

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbNext dest_node

goal (3 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
 2. mdbNext (cteMDBNode ctep) \<noteq> src
 3. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node

goal (2 subgoals):
 1. mdbNext (cteMDBNode ctep) \<noteq> src
 2. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> src proof (prove)
using this:
m dest = Some (CTE dest_cap dest_node)
m p = Some ctep
p = mdbNext dest_node
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> src proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> src

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m p = Some ctep
p = mdbNext dest_node
m \<turnstile> s_d_swp p \<leadsto> s_d_swp (mdbNext (cteMDBNode cte))
mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node
mdbNext dest_node \<noteq> mdbPrev src_node
mdbNext src_node \<noteq> dest
mdbPrev dest_node \<noteq> src
mdbNext dest_node \<noteq> src
mdbPrev src_node \<noteq> dest
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node proof (state)
this:
mdbNext (cteMDBNode ctep) \<noteq> mdbNext src_node

goal:
No subgoals! proof (state)
this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))

goal (1 subgoal):
 1. mdbNext (cteMDBNode ctep) \<noteq> mdbPrev src_node \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n (mdbNext (cteMDBNode ctep)) = m (mdbNext (cteMDBNode ctep))
mdbNext (cteMDBNode cte) = mdbNext (cteMDBNode ctep)
m (mdbNext (cteMDBNode cte)) = Some cte'
m p = Some ctep
p = mdbNext dest_node
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. n p = m p proof (state)
this:
n p = m p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
n p = m p

goal (1 subgoal):
 1. cte = ctep proof (prove)
using this:
n p = m p
m p = Some ctep
n p = Some cte

goal (1 subgoal):
 1. cte = ctep proof (state)
this:
cte = ctep

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<noteq> src proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src \<Longrightarrow> False proof (prove)
using this:
mdbNext (cteMDBNode cte) = src

goal (1 subgoal):
 1. p = mdbPrev src_node proof (prove)
using this:
mdbNext (cteMDBNode cte) = src
m p = Some ctep
m (mdbNext (cteMDBNode cte)) = Some cte'
m src = Some (CTE src_cap src_node)
cte = ctep
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. p = mdbPrev src_node proof (state)
this:
p = mdbPrev src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = src \<Longrightarrow> False proof (prove)
using this:
p = mdbPrev src_node

goal (1 subgoal):
 1. False proof (prove)
using this:
p = mdbPrev src_node
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> src

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<noteq> mdbNext src_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node \<Longrightarrow> False proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node

goal (1 subgoal):
 1. src = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext src_node
m p = Some ctep
cte = ctep
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. src = p proof (state)
this:
src = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext src_node \<Longrightarrow> False proof (prove)
using this:
src = p

goal (1 subgoal):
 1. False proof (prove)
using this:
src = p
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> mdbNext src_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<noteq> dest proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest \<Longrightarrow> False proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest

goal (1 subgoal):
 1. p = mdbPrev dest_node proof (prove)
using this:
mdbNext (cteMDBNode cte) = dest
m p = Some ctep
m (mdbNext (cteMDBNode cte)) = Some cte'
m dest = Some (CTE dest_cap dest_node)
cte = ctep
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. p = mdbPrev dest_node proof (state)
this:
p = mdbPrev dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = dest \<Longrightarrow> False proof (prove)
using this:
p = mdbPrev dest_node

goal (1 subgoal):
 1. False proof (prove)
using this:
p = mdbPrev dest_node
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> dest

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) \<noteq> mdbNext dest_node proof (state)
goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node \<Longrightarrow> False proof (state)
this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node \<Longrightarrow> False proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node

goal (1 subgoal):
 1. dest = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbNext dest_node
m p = Some ctep
cte = ctep
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. dest = p proof (state)
this:
dest = p

goal (1 subgoal):
 1. mdbNext (cteMDBNode cte) = mdbNext dest_node \<Longrightarrow> False proof (prove)
using this:
dest = p

goal (1 subgoal):
 1. False proof (prove)
using this:
dest = p
p \<noteq> mdbPrev src_node
p \<noteq> src
p \<noteq> mdbNext src_node
p \<noteq> mdbPrev dest_node
p \<noteq> dest
p \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. False proof (state)
this:
False

goal:
No subgoals! proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (chain)
picking this:
mdbNext (cteMDBNode cte) \<in> dom n proof (prove)
using this:
mdbNext (cteMDBNode cte) \<in> dom n

goal (1 subgoal):
 1. (\<And>cten. n (mdbNext (cteMDBNode cte)) = Some cten \<Longrightarrow> thesis) \<Longrightarrow> thesis proof (state)
this:
n (mdbNext (cteMDBNode cte)) = Some cten

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
m p = Some ctep
m (mdbNext (cteMDBNode cte)) = Some cte'

goal (1 subgoal):
 1. mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>p \<noteq> mdbPrev src_node; p \<noteq> src; p \<noteq> mdbNext src_node; p \<noteq> mdbPrev dest_node; p \<noteq> dest; p \<noteq> mdbNext dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (4 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node

goal (4 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 4. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node
mdbNext (cteMDBNode cte) \<noteq> 0

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (3 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (3 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (3 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) = mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 3. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) = mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
n (mdbNext (cteMDBNode cte)) = Some cten
mdbNext (cteMDBNode cte) \<noteq> dest
mdbNext (cteMDBNode cte) \<noteq> mdbNext dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (2 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (2 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node

goal (2 subgoals):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) = mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p
 2. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) = mdbPrev dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
n (mdbNext (cteMDBNode cte)) = Some cten
mdbNext (cteMDBNode cte) \<noteq> src
mdbNext (cteMDBNode cte) \<noteq> mdbNext src_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<lbrakk>mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node; mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node\<rbrakk> \<Longrightarrow> \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (prove)
using this:
mdbNext (cteMDBNode cte) \<noteq> mdbPrev src_node
mdbNext (cteMDBNode cte) \<noteq> mdbPrev dest_node
m (mdbNext (cteMDBNode cte)) = Some cte'
n (mdbNext (cteMDBNode cte)) = Some cten
mdbNext (cteMDBNode cte) \<noteq> src
mdbNext (cteMDBNode cte) \<noteq> mdbNext src_node
mdbNext (cteMDBNode cte) \<noteq> dest
mdbNext (cteMDBNode cte) \<noteq> mdbNext dest_node
mdbPrev (cteMDBNode cte') = p

goal (1 subgoal):
 1. \<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals! proof (state)
this:
\<exists>cte'. n (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = p

goal:
No subgoals!