l3lab/ntp-mathlib huggingface dataset:
theorem evaln_mono : ∀ {k₁ k₂ c n x}, k₁ ≤ k₂ → x ∈ evaln k₁ c n → x ∈ evaln k₂ c n
  | 0, k₂, c, n, x, _, h => by simp [evaln] at h
  | k + 1, k₂ + 1, c, n, x, hl, h => by
    have hl' := Nat.le_of_succ_le_succ hl
    have :
      ∀ {k k₂ n x : ℕ} {o₁ o₂ : Option ℕ},
        k ≤ k₂ → (x ∈ o₁ → x ∈ o₂) →
          x ∈ do { guard (n ≤ k); o₁ } → x ∈ do { guard (n ≤ k₂); o₂ } := by
      simp only [Option.mem_def, bind, Option.bind_eq_some, Option.guard_eq_some', exists_and_left,
        exists_const, and_imp]
      introv h h₁ h₂ h₃
      exact ⟨le_trans h₂ h, h₁ h₃⟩
    simp? at h ⊢ says simp only [Option.mem_def] at h ⊢
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
      rw [evaln] at h ⊢ <;> refine' this hl' (fun h => _) h
    iterate 4 exact h
    · -- pair cf cg
      simp? [Seq.seq] at h ⊢ says
        simp only [Seq.seq, Option.map_eq_map, Option.mem_def, Option.bind_eq_some,
          Option.map_eq_some', exists_exists_and_eq_and] at h ⊢
      exact h.imp fun a => And.imp (hf _ _) <| Exists.imp fun b => And.imp_left (hg _ _)
    · -- comp cf cg
      simp? [Bind.bind] at h ⊢ says simp only [bind, Option.mem_def, Option.bind_eq_some] at h ⊢
      exact h.imp fun a => And.imp (hg _ _) (hf _ _)
    · -- prec cf cg
      revert h
      simp only [unpaired, bind, Option.mem_def]
      induction n.unpair.2 <;> simp
      · apply hf
      · exact fun y h₁ h₂ => ⟨y, evaln_mono hl' h₁, hg _ _ h₂⟩
    · -- rfind' cf
      simp? [Bind.bind] at h ⊢ says
        simp only [unpaired, bind, pair_unpair, Option.mem_def, Option.bind_eq_some] at h ⊢
      refine' h.imp fun x => And.imp (hf _ _) _
      by_cases x0 : x = 0 <;> simp [x0]
      

Proof state:
case neg
k k₂ : ℕ
hl : k + 1 ≤ k₂ + 1
hl' : k ≤ k₂
this :
  ∀ {k k₂ n x : ℕ} {o₁ o₂ : Option ℕ},
    k ≤ k₂ →
      (x ∈ o₁ → x ∈ o₂) →
        (x ∈ do
            guard (n ≤ k)
            o₁) →
          x ∈ do
            guard (n ≤ k₂)
            o₂
cf : Code
hf : ∀ (n x : ℕ), evaln (k + 1) cf n = some x → evaln (k₂ + 1) cf n = some x
n x✝ : ℕ
h✝ :
  (fun n => do
        guard (n ≤ k)
        unpaired
            (fun a m => do
              let x ← evaln (k + 1) cf (Nat.pair a m)
              if x = 0 then pure m else evaln k (rfind' cf) (Nat.pair a (m + 1)))
            n)
      n =
    some x✝
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x✝
x : ℕ
x0 : ¬x = 0
⊢ evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1)) = some x✝ →
    evaln k₂ (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1)) = some x✝

Next tactic:
exact evaln_mono hl'
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by 

Proof state:
x✝ : Code
n x : ℕ
h : x ∈ evaln 0 x✝ n
⊢ x ∈ eval x✝ n

Next tactic:
simp [evaln] at h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    

Proof state:
k : ℕ
c : Code
n x : ℕ
h : x ∈ evaln (k + 1) c n
⊢ x ∈ eval c n

Next tactic:
induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case zero
k n x : ℕ
h : x ∈ evaln (k + 1) zero n
⊢ x ∈ eval zero n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case succ
k n x : ℕ
h : x ∈ evaln (k + 1) succ n
⊢ x ∈ eval succ n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case left
k n x : ℕ
h : x ∈ evaln (k + 1) left n
⊢ x ∈ eval left n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case right
k n x : ℕ
h : x ∈ evaln (k + 1) right n
⊢ x ∈ eval right n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case pair
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h : x ∈ evaln (k + 1) (pair cf cg) n
⊢ x ∈ eval (pair cf cg) n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case comp
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h : x ∈ evaln (k + 1) (comp cf cg) n
⊢ x ∈ eval (comp cf cg) n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case prec
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h : x ∈ evaln (k + 1) (prec cf cg) n
⊢ x ∈ eval (prec cf cg) n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        

Proof state:
case rfind'
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
h : x ∈ evaln (k + 1) (rfind' cf) n
⊢ x ∈ eval (rfind' cf) n

Next tactic:
simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case zero
k n x : ℕ
h : n ≤ k ∧ pure 0 = some x
⊢ x ∈ pure 0 n

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case succ
k n x : ℕ
h : n ≤ k ∧ pure (Nat.succ n) = some x
⊢ x = Nat.succ n

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case left
k n x : ℕ
h : n ≤ k ∧ pure (unpair n).1 = some x
⊢ x = (unpair n).1

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case right
k n x : ℕ
h : n ≤ k ∧ pure (unpair n).2 = some x
⊢ x = (unpair n).2

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case pair
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h : n ≤ k ∧ ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case comp
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h : n ≤ k ∧ ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case prec
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
h :
  n ≤ k ∧
    Nat.rec (evaln (k + 1) cf (unpair n).1)
        (fun n_1 n_ih =>
          Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
            evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
        (unpair n).2 =
      some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      

Proof state:
case rfind'
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
h :
  n ≤ k ∧
    ∃ a,
      evaln (k + 1) cf n = some a ∧
        (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
cases' h with _ h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    

Proof state:
case zero.intro
k n x : ℕ
left✝ : n ≤ k
h : pure 0 = some x
⊢ x ∈ pure 0 n
case succ.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (Nat.succ n) = some x
⊢ x = Nat.succ n
case left.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).1 = some x
⊢ x = (unpair n).1
case right.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).2 = some x
⊢ x = (unpair n).2
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x
case comp.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a
case prec.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h :
  Nat.rec (evaln (k + 1) cf (unpair n).1)
      (fun n_1 n_ih =>
        Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
          evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
      (unpair n).2 =
    some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2
case rfind'.intro
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
left✝ : n ≤ k
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
iterate 4 simpa [pure, PFun.pure, eq_comm] using h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 

Proof state:
case zero.intro
k n x : ℕ
left✝ : n ≤ k
h : pure 0 = some x
⊢ x ∈ pure 0 n
case succ.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (Nat.succ n) = some x
⊢ x = Nat.succ n
case left.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).1 = some x
⊢ x = (unpair n).1
case right.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).2 = some x
⊢ x = (unpair n).2
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x
case comp.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a
case prec.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h :
  Nat.rec (evaln (k + 1) cf (unpair n).1)
      (fun n_1 n_ih =>
        Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
          evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
      (unpair n).2 =
    some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2
case rfind'.intro
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
left✝ : n ≤ k
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
simpa [pure, PFun.pure, eq_comm] using h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 

Proof state:
case succ.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (Nat.succ n) = some x
⊢ x = Nat.succ n
case left.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).1 = some x
⊢ x = (unpair n).1
case right.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).2 = some x
⊢ x = (unpair n).2
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x
case comp.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a
case prec.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h :
  Nat.rec (evaln (k + 1) cf (unpair n).1)
      (fun n_1 n_ih =>
        Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
          evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
      (unpair n).2 =
    some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2
case rfind'.intro
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
left✝ : n ≤ k
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
simpa [pure, PFun.pure, eq_comm] using h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 

Proof state:
case left.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).1 = some x
⊢ x = (unpair n).1
case right.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).2 = some x
⊢ x = (unpair n).2
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x
case comp.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a
case prec.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h :
  Nat.rec (evaln (k + 1) cf (unpair n).1)
      (fun n_1 n_ih =>
        Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
          evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
      (unpair n).2 =
    some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2
case rfind'.intro
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
left✝ : n ≤ k
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
simpa [pure, PFun.pure, eq_comm] using h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 

Proof state:
case right.intro
k n x : ℕ
left✝ : n ≤ k
h : pure (unpair n).2 = some x
⊢ x = (unpair n).2
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x
case comp.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cg n = some a ∧ evaln (k + 1) cf a = some x
⊢ ∃ a ∈ eval cg n, x ∈ eval cf a
case prec.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h :
  Nat.rec (evaln (k + 1) cf (unpair n).1)
      (fun n_1 n_ih =>
        Option.bind (evaln k (prec cf cg) (Nat.pair (unpair n).1 n_1)) fun i =>
          evaln (k + 1) cg (Nat.pair (unpair n).1 (Nat.pair n_1 i)))
      (unpair n).2 =
    some x
⊢ x ∈
    Nat.rec (eval cf (unpair n).1) (fun y IH => Part.bind IH fun i => eval cg (Nat.pair (unpair n).1 (Nat.pair y i)))
      (unpair n).2
case rfind'.intro
k : ℕ
cf : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
n x : ℕ
left✝ : n ≤ k
h :
  ∃ a,
    evaln (k + 1) cf n = some a ∧
      (if a = 0 then pure (unpair n).2 else evaln k (rfind' cf) (Nat.pair (unpair n).1 ((unpair n).2 + 1))) = some x
⊢ ∃ a,
    (0 ∈ eval cf (Nat.pair (unpair n).1 (a + (unpair n).2)) ∧
        ∀ {m : ℕ}, m < a → ∃ a ∈ eval cf (Nat.pair (unpair n).1 (m + (unpair n).2)), ¬a = 0) ∧
      a + (unpair n).2 = x

Next tactic:
simpa [pure, PFun.pure, eq_comm] using h
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 simpa [pure, PFun.pure, eq_comm] using h
    · -- pair cf cg
      

Proof state:
case pair.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n x : ℕ
left✝ : n ≤ k
h : ∃ a, evaln (k + 1) cf n = some a ∧ ∃ a_1, evaln (k + 1) cg n = some a_1 ∧ Nat.pair a a_1 = x
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = x

Next tactic:
rcases h with ⟨y, ef, z, eg, rfl⟩
theorem evaln_sound : ∀ {k c n x}, x ∈ evaln k c n → x ∈ eval c n
  | 0, _, n, x, h => by simp [evaln] at h
  | k + 1, c, n, x, h => by
    induction' c with cf cg hf hg cf cg hf hg cf cg hf hg cf hf generalizing x n <;>
        simp [eval, evaln, Bind.bind, Seq.seq] at h ⊢ <;>
      cases' h with _ h
    iterate 4 simpa [pure, PFun.pure, eq_comm] using h
    · -- pair cf cg
      rcases h with ⟨y, ef, z, eg, rfl⟩
      

Proof state:
case pair.intro.intro.intro.intro.intro
k : ℕ
cf cg : Code
hf : ∀ (n x : ℕ), x ∈ evaln (k + 1) cf n → x ∈ eval cf n
hg : ∀ (n x : ℕ), x ∈ evaln (k + 1) cg n → x ∈ eval cg n
n : ℕ
left✝ : n ≤ k
y : ℕ
ef : evaln (k + 1) cf n = some y
z : ℕ
eg : evaln (k + 1) cg n = some z
⊢ ∃ a ∈ eval cf n, ∃ a_1 ∈ eval cg n, Nat.pair a a_1 = Nat.pair y z

Next tactic:
exact ⟨_, hf _ _ ef, _, hg _ _ eg, rfl⟩