diff --git a/thys/MiniSail/BTVSubst.thy b/thys/MiniSail/BTVSubst.thy
--- a/thys/MiniSail/BTVSubst.thy
+++ b/thys/MiniSail/BTVSubst.thy
@@ -1,1550 +1,1550 @@
 (*<*)
 theory BTVSubst
   imports Syntax
 begin
   (*>*)
 chapter \<open>Basic Type Variable Substitution\<close>
 
 section \<open>Class\<close>
 
 class has_subst_b = fs +
   fixes subst_b :: "'a::fs \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> 'a::fs" ("_[_::=_]\<^sub>b" [1000,50,50] 1000)
 
 assumes fresh_subst_if:  "j \<sharp> (t[i::=x]\<^sub>b )  \<longleftrightarrow> (atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))" 
   and    forget_subst[simp]:  "atom a \<sharp> tm \<Longrightarrow> tm[a::=x]\<^sub>b  = tm"
   and    subst_id[simp]:      "tm[a::=(B_var a)]\<^sub>b  = tm"
   and    eqvt[simp,eqvt]:          "(p::perm) \<bullet> (subst_b t1 x1 v ) = (subst_b (p \<bullet>t1) (p \<bullet>x1) (p \<bullet>v) )"
   and    flip_subst[simp]:    "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
   and    flip_subst_subst[simp]: "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
 begin
 
 lemmas flip_subst_b = flip_subst_subst
 
 lemma subst_b_simple_commute:
   fixes x::bv
   assumes "atom x \<sharp> c" 
   shows "(c[z::=B_var x]\<^sub>b)[x::=b]\<^sub>b = c[z::=b]\<^sub>b" 
 proof - 
   have "(c[z::=B_var x]\<^sub>b)[x::=b]\<^sub>b = (( x \<leftrightarrow> z) \<bullet> c)[x::=b]\<^sub>b" using flip_subst assms by simp
   thus ?thesis using flip_subst_subst assms by simp
 qed
 
 lemma subst_b_flip_eq_one:
   fixes z1::bv and z2::bv and x1::bv and x2::bv  
   assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
     and "atom x1 \<sharp> (z1,z2,c1,c2)"
   shows "(c1[z1::=B_var x1]\<^sub>b) = (c2[z2::=B_var x1]\<^sub>b)"
 proof -  
   have "(c1[z1::=B_var x1]\<^sub>b) = (x1 \<leftrightarrow> z1) \<bullet> c1" using assms flip_subst by auto
   moreover have  "(c2[z2::=B_var x1]\<^sub>b) = (x1 \<leftrightarrow> z2) \<bullet> c2" using assms flip_subst by auto
   ultimately show ?thesis using Abs1_eq_iff_all(3)[of z1 c1 z2 c2 z1]  assms 
     by (metis Abs1_eq_iff_fresh(3) flip_commute)
 qed
 
 lemma subst_b_flip_eq_two:
   fixes z1::bv and z2::bv and x1::bv and x2::bv  
   assumes "[[atom z1]]lst. c1 = [[atom z2]]lst. c2" 
   shows "(c1[z1::=b]\<^sub>b) = (c2[z2::=b]\<^sub>b)"
 proof -
   obtain x::bv where *:"atom x \<sharp> (z1,z2,c1,c2)" using obtain_fresh by metis
   hence "(c1[z1::=B_var x]\<^sub>b) = (c2[z2::=B_var x]\<^sub>b)" using subst_b_flip_eq_one[OF assms, of x] by metis
   hence "(c1[z1::=B_var x]\<^sub>b)[x::=b]\<^sub>b = (c2[z2::=B_var x]\<^sub>b)[x::=b]\<^sub>b" by auto
   thus ?thesis using subst_b_simple_commute * fresh_prod4 by metis
 qed
 
 lemma subst_b_fresh_x:
   fixes tm::"'a::fs" and x::x
   shows "atom x \<sharp> tm = atom x \<sharp> tm[bv::=b']\<^sub>b"
   using fresh_subst_if[of "atom x" tm bv b'] using x_fresh_b by auto
 
 lemma subst_b_x_flip[simp]:
   fixes x'::x and x::x and bv::bv 
   shows "((x' \<leftrightarrow> x) \<bullet> tm)[bv::=b']\<^sub>b = (x' \<leftrightarrow> x) \<bullet> (tm[bv::=b']\<^sub>b)"
 proof - 
   have "(x' \<leftrightarrow> x) \<bullet> bv = bv" using pure_supp flip_fresh_fresh by force
   moreover have "(x' \<leftrightarrow> x) \<bullet> b' = b'" using x_fresh_b flip_fresh_fresh by auto
   ultimately show ?thesis using eqvt by simp
 qed
 
 end
 
 section \<open>Base Type\<close>
 
 nominal_function subst_bb :: "b \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> b" where
   "subst_bb  (B_var bv2) bv1 b  = (if bv1 = bv2 then b else (B_var bv2))"
 | "subst_bb  B_int bv1 b  = B_int"
 | "subst_bb B_bool bv1 b = B_bool"
 | "subst_bb (B_id s) bv1 b = B_id s "
 | "subst_bb (B_pair b1 b2) bv1 b = B_pair (subst_bb b1 bv1 b) (subst_bb b2 bv1 b)"
 | "subst_bb B_unit bv1 b = B_unit  "
 | "subst_bb B_bitvec bv1 b = B_bitvec "
 | "subst_bb (B_app s b2) bv1 b = B_app s (subst_bb b2 bv1 b)"
                       apply (simp add: eqvt_def subst_bb_graph_aux_def )
                       apply (simp add: eqvt_def subst_bb_graph_aux_def )
   by (auto,meson b.strong_exhaust)
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_bb_abbrev :: "b \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> b" ("_[_::=_]\<^sub>b\<^sub>b" [1000,50,50] 1000)
   where 
     "b[bv::=b']\<^sub>b\<^sub>b  \<equiv> subst_bb b bv b' " 
 
 instantiation b :: has_subst_b
 begin
 definition "subst_b = subst_bb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::b
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof (induct t rule: b.induct)
     case (B_id x)
     then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
   next
     case (B_var x)
     then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
   next
     case (B_app x1 x2)
     then show ?case using subst_bb.simps fresh_def pure_fresh subst_b_b_def by auto
   qed(auto simp add: subst_bb.simps fresh_def pure_fresh subst_b_b_def)+
 
   fix a::bv and tm::b and x::b
   show "atom a \<sharp> tm \<Longrightarrow> tm[a::=x]\<^sub>b = tm"
     by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
 
   fix a::bv and tm::b
   show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
     by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
 
   fix p::perm and x1::bv and v::b and t1::b
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
     by (induct tm rule: b.induct, auto simp add: fresh_at_base subst_bb.simps subst_b_b_def)
 
   fix  bv::bv and c::b and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     by (induct c rule: b.induct,  (auto simp add: fresh_at_base subst_bb.simps subst_b_b_def permute_pure pure_supp )+)
 
   fix bv::bv and c::b and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     by (induct c rule: b.induct,  (auto simp add: fresh_at_base subst_bb.simps subst_b_b_def permute_pure pure_supp )+)
 qed
 end
 
 lemma subst_bb_inject:
   assumes "b1 = b2[bv::=b]\<^sub>b\<^sub>b" and "b2 \<noteq> B_var bv" 
   shows 
     "b1 = B_int \<Longrightarrow> b2 = B_int" and 
     "b1 = B_bool \<Longrightarrow> b2 = B_bool" and 
     "b1 = B_unit \<Longrightarrow> b2 = B_unit" and 
     "b1 = B_bitvec \<Longrightarrow> b2 = B_bitvec" and 
     "b1 = B_pair b11 b12 \<Longrightarrow> (\<exists>b11' b12' . b11 = b11'[bv::=b]\<^sub>b\<^sub>b \<and> b12 = b12'[bv::=b]\<^sub>b\<^sub>b \<and> b2 = B_pair b11' b12')" and
     "b1 = B_var bv' \<Longrightarrow> b2 = B_var bv'" and
     "b1 = B_id tyid  \<Longrightarrow> b2 = B_id tyid" and
     "b1 = B_app tyid b11 \<Longrightarrow> (\<exists>b11'. b11= b11'[bv::=b]\<^sub>b\<^sub>b \<and> b2 = B_app tyid b11')"
   using assms by(nominal_induct b2 rule:b.strong_induct,auto+)
 
 lemma flip_b_subst4:
   fixes b1::b and bv1::bv and c::bv and b::b
   assumes "atom c \<sharp> (b1,bv1)" 
   shows "b1[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> b1)[c ::= b]\<^sub>b\<^sub>b" 
   using assms proof(nominal_induct b1 rule: b.strong_induct)
   case B_int
   then show ?case using subst_bb.simps b.perm_simps by auto
 next
   case B_bool
   then show ?case using subst_bb.simps b.perm_simps by auto
 next
   case (B_id x)
   hence "atom bv1 \<sharp> x \<and> atom c \<sharp> x" using fresh_def  pure_supp by auto
   hence "((bv1 \<leftrightarrow> c) \<bullet> B_id x) = B_id x" using fresh_Pair b.fresh(3) flip_fresh_fresh b.perm_simps fresh_def pure_supp by metis
   then show ?case using subst_bb.simps by simp
 next
   case (B_pair x1 x2)
   hence "x1[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x1)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps(4) b.fresh(4) fresh_Pair  by metis
   moreover have  "x2[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x2)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps(4) b.fresh(4) fresh_Pair B_pair by metis
   ultimately  show ?case using subst_bb.simps(5) b.perm_simps(4) b.fresh(4) fresh_Pair by auto
 next
   case B_unit
   then show ?case using subst_bb.simps b.perm_simps by auto
 next
   case B_bitvec
   then show ?case using subst_bb.simps b.perm_simps by auto
 next
   case (B_var x)
   then show ?case proof(cases "x=bv1")
     case True
     then show ?thesis using B_var subst_bb.simps b.perm_simps by simp
   next
     case False
     moreover have "x\<noteq>c" using B_var b.fresh fresh_def supp_at_base fresh_Pair by fastforce
     ultimately show ?thesis using B_var subst_bb.simps(1) b.perm_simps(7) by simp
   qed
 next
   case (B_app x1 x2)
   hence "x2[bv1::=b]\<^sub>b\<^sub>b = ((bv1 \<leftrightarrow> c) \<bullet> x2)[c::=b]\<^sub>b\<^sub>b" using  b.perm_simps b.fresh fresh_Pair  by metis 
   thus ?case using subst_bb.simps b.perm_simps b.fresh fresh_Pair B_app 
     by (simp add: permute_pure)
 qed
 
 lemma subst_bb_flip_sym:
   fixes b1::b and b2::b
   assumes "atom c \<sharp> b" and "atom c \<sharp> (bv1,bv2, b1, b2)" and "(bv1 \<leftrightarrow> c) \<bullet> b1 = (bv2 \<leftrightarrow> c) \<bullet> b2" 
   shows "b1[bv1::=b]\<^sub>b\<^sub>b = b2[bv2::=b]\<^sub>b\<^sub>b"
   using assms  flip_b_subst4[of c b1 bv1 b]   flip_b_subst4[of c b2 bv2 b] fresh_prod4 fresh_Pair by simp
 
 section \<open>Value\<close>
 
 nominal_function subst_vb :: "v \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> v" where
   "subst_vb (V_lit l) x v = V_lit l"
 | "subst_vb (V_var y) x v = V_var y"
 | "subst_vb (V_cons tyid c v') x v  = V_cons tyid c (subst_vb v' x v)"
 | "subst_vb (V_consp tyid c b v') x v  = V_consp tyid c (subst_bb b x v) (subst_vb v' x v)"
 | "subst_vb (V_pair v1 v2) x v = V_pair (subst_vb v1 x v ) (subst_vb v2 x v )"
                    apply (simp add: eqvt_def subst_vb_graph_aux_def)
                   apply auto
   using v.strong_exhaust by meson
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_vb_abbrev :: "v \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> v" ("_[_::=_]\<^sub>v\<^sub>b" [1000,50,50] 500)
   where 
     "e[bv::=b]\<^sub>v\<^sub>b  \<equiv> subst_vb e bv b" 
 
 instantiation v :: has_subst_b
 begin
 definition "subst_b = subst_vb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::v
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof (induct t rule: v.induct)
     case (V_lit l)
     have "j \<sharp> subst_b (V_lit l) i x = j \<sharp> (V_lit l)"  using subst_vb.simps fresh_def pure_fresh 
         subst_b_v_def v.supp  v.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by auto
     also have "... = True" using fresh_at_base v.fresh l.fresh supp_l_empty fresh_def by metis      
     moreover have "(atom i \<sharp>  (V_lit l) \<and> j \<sharp>  (V_lit l) \<or> j \<sharp> x \<and> (j \<sharp>  (V_lit l) \<or> j = atom i)) = True" using fresh_at_base v.fresh l.fresh supp_l_empty fresh_def by metis
     ultimately show ?case by simp
   next
     case (V_var y)
     then show ?case using  subst_b_v_def subst_vb.simps pure_fresh by force   
   next
     case (V_pair x1a x2a)
     then show ?case using subst_b_v_def subst_vb.simps by auto  
   next
     case (V_cons x1a x2a x3)       
     then show ?case using V_cons subst_b_v_def subst_vb.simps pure_fresh by force
   next
     case (V_consp x1a x2a x3 x4)
     then show ?case using  subst_b_v_def subst_vb.simps pure_fresh  has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by fastforce
   qed
 
   fix a::bv and tm::v and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
     apply(induct tm rule: v.induct)
         apply(auto simp add: fresh_at_base subst_vb.simps subst_b_v_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.forget_subst by fastforce
 
   fix a::bv and tm::v
   show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
     apply (induct tm rule: v.induct)
         apply(auto simp add: fresh_at_base subst_vb.simps subst_b_v_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.subst_id by metis
 
   fix p::perm and x1::bv and v::b and t1::v
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
     apply(induct tm rule: v.induct)
         apply(auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
     using has_subst_b_class.eqvt  subst_b_b_def e.fresh 
     using has_subst_b_class.eqvt 
     by (simp add: subst_b_v_def)+
 
   fix  bv::bv and c::v and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (induct c rule: v.induct,  (auto simp add: fresh_at_base  subst_vb.simps subst_b_v_def permute_pure pure_supp )+)
      apply (metis flip_fresh_fresh flip_l_eq permute_flip_cancel2)
     using  fresh_at_base flip_fresh_fresh[of bv  x z] 
     apply (simp add: flip_fresh_fresh)
     using subst_b_b_def by argo
 
   fix bv::bv and c::v and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     apply (induct c rule: v.induct,  (auto simp add: fresh_at_base  subst_vb.simps subst_b_v_def permute_pure pure_supp )+)
      apply (metis flip_fresh_fresh flip_l_eq permute_flip_cancel2)
     using  fresh_at_base flip_fresh_fresh[of bv  x z] 
     apply (simp add: flip_fresh_fresh)
     using     subst_b_b_def  flip_subst_subst by fastforce
 
 qed
 end
 
 section \<open>Constraints Expressions\<close>
 
 nominal_function subst_ceb :: "ce \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> ce" where
   "subst_ceb  ( (CE_val v') ) bv b = ( CE_val (subst_vb v' bv b) )"
 | "subst_ceb  ( (CE_op opp v1 v2) ) bv b = ( (CE_op opp (subst_ceb v1 bv b)(subst_ceb v2 bv b)) )"
 | "subst_ceb  ( (CE_fst v')) bv b = CE_fst (subst_ceb v' bv b)"
 | "subst_ceb  ( (CE_snd v')) bv b = CE_snd (subst_ceb v' bv b)"
 | "subst_ceb  ( (CE_len v')) bv b = CE_len (subst_ceb v' bv b)"
 | "subst_ceb  ( CE_concat v1 v2) bv b = CE_concat (subst_ceb v1 bv b) (subst_ceb v2 bv b)"
                       apply (simp add: eqvt_def subst_ceb_graph_aux_def)
                       apply auto
   by (meson ce.strong_exhaust)
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_ceb_abbrev :: "ce \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> ce" ("_[_::=_]\<^sub>c\<^sub>e\<^sub>b" [1000,50,50] 500)
   where 
     "ce[bv::=b]\<^sub>c\<^sub>e\<^sub>b  \<equiv> subst_ceb ce bv b" 
 
 instantiation ce :: has_subst_b
 begin
 definition "subst_b = subst_ceb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::ce
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof (induct t rule: ce.induct)
     case (CE_val v)
     then show ?case using subst_ceb.simps fresh_def pure_fresh subst_b_ce_def ce.supp v.supp  ce.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def
       by metis
   next
     case (CE_op opp v1 v2)    
 
     have "(j \<sharp> v1[i::=x]\<^sub>c\<^sub>e\<^sub>b \<and> j \<sharp> v2[i::=x]\<^sub>c\<^sub>e\<^sub>b) = ((atom i \<sharp> v1 \<and> atom i \<sharp> v2) \<and> j \<sharp> v1 \<and> j \<sharp> v2 \<or> j \<sharp> x \<and> (j \<sharp> v1 \<and> j \<sharp> v2 \<or> j = atom i))"
       using has_subst_b_class.fresh_subst_if subst_b_v_def 
       using CE_op.hyps(1) CE_op.hyps(2) subst_b_ce_def by auto
 
     thus ?case  unfolding subst_ceb.simps subst_b_ce_def ce.fresh 
       using fresh_def pure_fresh opp.fresh subst_b_v_def  opp.exhaust fresh_e_opp_all
       by (metis (full_types))      
   next
     case (CE_concat x1a x2)
     then show ?case  using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by force
   next
     case (CE_fst x)
     then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
 
   next
     case (CE_snd x)
     then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
   next
     case (CE_len x)
     then show ?case using subst_ceb.simps  subst_b_ce_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  ce.fresh by metis
   qed
 
   fix a::bv and tm::ce and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
     apply(induct tm rule: ce.induct)
          apply( auto simp add: fresh_at_base subst_ceb.simps subst_b_ce_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.forget_subst subst_b_v_def apply metis+
     done
 
   fix a::bv and tm::ce
   show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
     apply (induct tm rule: ce.induct)
          apply(auto simp add: fresh_at_base subst_ceb.simps subst_b_ce_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.subst_id subst_b_v_def apply metis+
     done
 
   fix p::perm and x1::bv and v::b and t1::ce
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
     apply(induct tm rule: ce.induct)
          apply( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
     using has_subst_b_class.eqvt  subst_b_b_def ce.fresh 
     using has_subst_b_class.eqvt 
     by (simp add: subst_b_ce_def)+
 
   fix  bv::bv and c::ce and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (induct c rule: ce.induct,  (auto simp add: fresh_at_base  subst_ceb.simps subst_b_ce_def permute_pure pure_supp )+)
     using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def apply metis
     using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def 
     by (simp add: flip_fresh_fresh fresh_opp_all)  
 
   fix bv::bv and c::ce and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
   proof (induct c rule: ce.induct)
     case (CE_val x)
     then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
   next
     case (CE_op x1a x2 x3)
     then show ?case unfolding subst_ceb.simps subst_b_ce_def ce.perm_simps using flip_subst_subst subst_b_v_def  opp.perm_simps opp.strong_exhaust 
       by (metis (full_types) ce.fresh(2))
   next
     case (CE_concat x1a x2)
     then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
   next
     case (CE_fst x)
     then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
   next
     case (CE_snd x)
     then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
   next
     case (CE_len x)
     then show ?case using flip_subst_subst subst_b_v_def subst_ceb.simps  using subst_b_ce_def by fastforce
   qed
 qed
 end
 
 section \<open>Constraints\<close>
 
 nominal_function subst_cb :: "c \<Rightarrow> bv \<Rightarrow> b  \<Rightarrow> c" where
   "subst_cb (C_true) x v = C_true"
 |  "subst_cb (C_false) x v = C_false"
 |  "subst_cb (C_conj c1 c2) x v = C_conj (subst_cb c1 x v ) (subst_cb c2 x v )"
 |  "subst_cb (C_disj c1 c2) x v = C_disj (subst_cb c1 x v ) (subst_cb c2 x v )"
 |  "subst_cb (C_imp c1 c2) x v = C_imp (subst_cb c1 x v ) (subst_cb c2 x v )"
 |  "subst_cb (C_eq e1 e2) x v = C_eq (subst_ceb e1 x v ) (subst_ceb e2 x v )"
 |  "subst_cb (C_not c) x v = C_not (subst_cb c x v )"
                       apply (simp add: eqvt_def subst_cb_graph_aux_def)
                       apply auto 
   using c.strong_exhaust apply metis
   done
 nominal_termination (eqvt)  by lexicographic_order
 
 abbreviation 
   subst_cb_abbrev :: "c \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> c" ("_[_::=_]\<^sub>c\<^sub>b" [1000,50,50] 500)
   where 
     "c[bv::=b]\<^sub>c\<^sub>b  \<equiv> subst_cb c bv b" 
 
 instantiation c :: has_subst_b
 begin
 definition "subst_b = subst_cb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::c
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
     by (induct t rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
         (metis has_subst_b_class.fresh_subst_if subst_b_ce_def c.fresh)+
         )
 
   fix a::bv and tm::c and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
     by(induct tm rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
         (metis has_subst_b_class.forget_subst subst_b_ce_def)+)
 
   fix a::bv and tm::c
   show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_c_def 
     by(induct tm rule: c.induct, unfold subst_cb.simps subst_b_c_def c.fresh,
         (metis has_subst_b_class.subst_id subst_b_ce_def)+)
 
   fix p::perm and x1::bv and v::b and t1::c
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
     apply(induct tm rule: c.induct,unfold subst_cb.simps subst_b_c_def c.fresh)
     by( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
 
   fix  bv::bv and c::c and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (induct c rule: c.induct,  (auto simp add: fresh_at_base  subst_cb.simps subst_b_c_def permute_pure pure_supp )+)
     using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def apply metis
     using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
     apply (metis opp.perm_simps(2) opp.strong_exhaust)+
     done
 
   fix bv::bv and c::c and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     apply (induct c rule: c.induct,  (auto simp add: fresh_at_base  subst_cb.simps subst_b_c_def permute_pure pure_supp )+)
     using flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
     using flip_subst_subst apply fastforce
     using  flip_fresh_fresh flip_l_eq permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_ce_def 
       opp.perm_simps(2) opp.strong_exhaust 
   proof -
     fix x1a :: ce and x2 :: ce
     assume a1: "atom bv \<sharp> x2"
     then have "((bv \<leftrightarrow> z) \<bullet> x2)[bv::=v]\<^sub>b = x2[z::=v]\<^sub>b"
       by (metis flip_subst_subst) (* 0.0 ms *)
     then show "x2[z::=B_var bv]\<^sub>b[bv::=v]\<^sub>c\<^sub>e\<^sub>b = x2[z::=v]\<^sub>c\<^sub>e\<^sub>b"
       using a1 by (simp add: subst_b_ce_def) (* 0.0 ms *)
   qed
 
 qed
 end
 
 section \<open>Types\<close>
 
 nominal_function subst_tb :: "\<tau> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<tau>" where
   "subst_tb  (\<lbrace> z : b2 | c \<rbrace>) bv1 b1 = \<lbrace> z : b2[bv1::=b1]\<^sub>b\<^sub>b | c[bv1::=b1]\<^sub>c\<^sub>b \<rbrace>"
 proof(goal_cases)
   case 1
   then show ?case using eqvt_def subst_tb_graph_aux_def by force
 next
   case (2 x y)
   then show ?case by auto
 next
   case (3 P x)
   then show ?case using eqvt_def subst_tb_graph_aux_def \<tau>.strong_exhaust 
     by (metis b_of.cases prod_cases3)
 next
   case (4 z' b2' c' bv1' b1' z b2 c bv1 b1)
   show ?case unfolding \<tau>.eq_iff proof
     have *:"[[atom z']]lst. c' = [[atom z]]lst. c" using  \<tau>.eq_iff 4 by auto
     show "[[atom z']]lst. c'[bv1'::=b1']\<^sub>c\<^sub>b = [[atom z]]lst. c[bv1::=b1]\<^sub>c\<^sub>b" 
     proof(subst Abs1_eq_iff_all(3),rule,rule,rule)
       fix ca::x
       assume "atom ca \<sharp> z" and 1:"atom ca \<sharp> (z', z, c'[bv1'::=b1']\<^sub>c\<^sub>b, c[bv1::=b1]\<^sub>c\<^sub>b)" 
       hence 2:"atom ca \<sharp> (c',c)" using fresh_subst_if subst_b_c_def fresh_Pair fresh_prod4 fresh_at_base subst_b_fresh_x by metis
       hence "(z' \<leftrightarrow> ca) \<bullet> c' = (z \<leftrightarrow> ca) \<bullet> c"  using 1 2 * Abs1_eq_iff_all(3) by auto
       hence "((z' \<leftrightarrow> ca) \<bullet> c')[bv1'::=b1']\<^sub>c\<^sub>b = ((z \<leftrightarrow> ca) \<bullet> c)[bv1'::=b1']\<^sub>c\<^sub>b" by auto      
       hence "(z' \<leftrightarrow> ca) \<bullet> c'[(z' \<leftrightarrow> ca) \<bullet> bv1'::=(z' \<leftrightarrow> ca) \<bullet> b1']\<^sub>c\<^sub>b = (z \<leftrightarrow> ca) \<bullet> c[(z \<leftrightarrow> ca) \<bullet> bv1'::=(z \<leftrightarrow> ca) \<bullet> b1']\<^sub>c\<^sub>b" by auto  
       thus "(z' \<leftrightarrow> ca) \<bullet> c'[bv1'::=b1']\<^sub>c\<^sub>b = (z \<leftrightarrow> ca) \<bullet> c[bv1::=b1]\<^sub>c\<^sub>b" using  4  flip_x_b_cancel by simp
     qed
     show "b2'[bv1'::=b1']\<^sub>b\<^sub>b = b2[bv1::=b1]\<^sub>b\<^sub>b" using 4 by simp
   qed
 qed
 
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_tb_abbrev :: "\<tau> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<tau>" ("_[_::=_]\<^sub>\<tau>\<^sub>b" [1000,50,50] 1000)
   where 
     "t[bv::=b']\<^sub>\<tau>\<^sub>b  \<equiv> subst_tb t bv b' " 
 
 instantiation \<tau> :: has_subst_b
 begin
 definition "subst_b = subst_tb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::\<tau>
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof (nominal_induct t avoiding: i x j rule: \<tau>.strong_induct)
     case (T_refined_type z b c)
     then show ?case
       unfolding subst_b_\<tau>_def  subst_tb.simps \<tau>.fresh
       using fresh_subst_if[of j b i x ] subst_b_b_def subst_b_c_def
       by (metis has_subst_b_class.fresh_subst_if list.distinct(1) list.set_cases not_self_fresh set_ConsD)
   qed
 
   fix a::bv and tm::\<tau> and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x  = tm"
   proof (nominal_induct tm avoiding: a x rule: \<tau>.strong_induct)
     case (T_refined_type xx bb cc )
     moreover hence "atom a \<sharp> bb \<and> atom a \<sharp> cc" using \<tau>.fresh by auto
     ultimately show   ?case  
       unfolding  subst_b_\<tau>_def subst_tb.simps 
       using forget_subst subst_b_b_def subst_b_c_def forget_subst \<tau>.fresh by metis
   qed
 
   fix a::bv and tm::\<tau>
   show "subst_b tm a (B_var a) = tm" 
   proof (nominal_induct tm rule: \<tau>.strong_induct)
     case (T_refined_type xx bb cc)
     thus  ?case  
       unfolding  subst_b_\<tau>_def subst_tb.simps 
       using subst_id subst_b_b_def subst_b_c_def by metis
   qed
 
   fix p::perm and x1::bv and v::b and t1::\<tau>
   show "p \<bullet> subst_b t1 x1 v = subst_b (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v) " 
     by (induct tm rule: \<tau>.induct, auto simp add: fresh_at_base subst_tb.simps subst_b_\<tau>_def subst_bb.simps subst_b_b_def)
 
   fix  bv::bv and c::\<tau> and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (induct c rule: \<tau>.induct,  (auto simp add: fresh_at_base  subst_ceb.simps subst_b_ce_def permute_pure pure_supp )+)
     using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_c_def  subst_b_b_def 
     by (simp add: flip_fresh_fresh subst_b_\<tau>_def)
 
   fix bv::bv and c::\<tau> and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
   proof (induct c rule: \<tau>.induct)
     case (T_refined_type x1a x2a x3a)
     hence "atom bv \<sharp> x2a \<and> atom bv \<sharp> x3a \<and> atom bv \<sharp> x1a" using fresh_at_base \<tau>.fresh by simp
     then show ?case 
       unfolding subst_tb.simps subst_b_\<tau>_def \<tau>.perm_simps 
       using fresh_at_base flip_fresh_fresh[of bv x1a z] flip_subst_subst subst_b_b_def  subst_b_c_def T_refined_type 
     proof -
       have "atom z \<sharp> x1a"
         by (metis b.fresh(7) fresh_at_base(2) x_fresh_b) (* 0.0 ms *)
       then show "\<lbrace> (bv \<leftrightarrow> z) \<bullet> x1a : ((bv \<leftrightarrow> z) \<bullet> x2a)[bv::=v]\<^sub>b\<^sub>b | ((bv \<leftrightarrow> z) \<bullet> x3a)[bv::=v]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x1a : x2a[z::=v]\<^sub>b\<^sub>b | x3a[z::=v]\<^sub>c\<^sub>b \<rbrace>"
         by (metis \<open>\<lbrakk>atom bv \<sharp> x1a; atom z \<sharp> x1a\<rbrakk> \<Longrightarrow> (bv \<leftrightarrow> z) \<bullet> x1a = x1a\<close> \<open>atom bv \<sharp> x2a \<and> atom bv \<sharp> x3a \<and> atom bv \<sharp> x1a\<close> flip_subst_subst subst_b_b_def subst_b_c_def) (* 78 ms *)
     qed 
   qed
 
 qed
 end
 
 lemma subst_bb_commute [simp]:
   "atom j \<sharp> A \<Longrightarrow> (subst_bb (subst_bb A i t ) j u ) = subst_bb A i (subst_bb t j u) "
   by (nominal_induct A avoiding: i j t u rule: b.strong_induct) (auto simp: fresh_at_base)
 
 lemma subst_vb_commute [simp]:
   "atom j \<sharp> A \<Longrightarrow> (subst_vb  (subst_vb A i t )) j u = subst_vb A i (subst_bb t j u ) "
   by (nominal_induct A avoiding: i j t u rule: v.strong_induct) (auto simp: fresh_at_base)
 
 lemma subst_ceb_commute [simp]:
   "atom j \<sharp> A \<Longrightarrow> (subst_ceb  (subst_ceb A i t )) j u = subst_ceb A i (subst_bb t j u ) "
   by (nominal_induct A avoiding: i j t u rule: ce.strong_induct) (auto simp: fresh_at_base)
 
 lemma subst_cb_commute [simp]:
   "atom j \<sharp> A \<Longrightarrow> (subst_cb  (subst_cb A i t )) j u = subst_cb A i (subst_bb t j u ) "
   by (nominal_induct A avoiding: i j t u rule: c.strong_induct) (auto simp: fresh_at_base)
 
 lemma subst_tb_commute [simp]:
   "atom j \<sharp> A \<Longrightarrow> (subst_tb  (subst_tb A i t )) j u = subst_tb A i (subst_bb t j u ) "
 proof (nominal_induct A avoiding: i j t u rule: \<tau>.strong_induct)
   case (T_refined_type z b c)
   then show ?case using subst_tb.simps subst_bb_commute subst_cb_commute by simp
 qed
 
 section \<open>Expressions\<close>
 
 nominal_function subst_eb :: "e \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> e" where
   "subst_eb ( (AE_val v')) bv b  = ( AE_val (subst_vb v' bv b))"
 | "subst_eb ( (AE_app f v') ) bv b = ( (AE_app f (subst_vb v' bv b)) )"                
 | "subst_eb ( (AE_appP f b' v') ) bv b = ( (AE_appP f (b'[bv::=b]\<^sub>b\<^sub>b) (subst_vb v' bv b)))"   
 | "subst_eb ( (AE_op opp v1 v2) ) bv b = ( (AE_op opp (subst_vb v1 bv b) (subst_vb v2 bv b)) )"
 | "subst_eb ( (AE_fst v')) bv b = AE_fst (subst_vb v' bv b)"
 | "subst_eb ( (AE_snd v')) bv b = AE_snd (subst_vb v' bv b)"
 | "subst_eb ( (AE_mvar u)) bv b = AE_mvar u"
 | "subst_eb ( (AE_len v')) bv b = AE_len (subst_vb v' bv b)"
 | "subst_eb ( AE_concat v1 v2) bv b = AE_concat (subst_vb v1 bv b) (subst_vb v2 bv b)"
 | "subst_eb ( AE_split v1 v2) bv b = AE_split (subst_vb v1 bv b) (subst_vb v2 bv b)"
                       apply (simp add: eqvt_def subst_eb_graph_aux_def)
                       apply auto
   by (meson e.strong_exhaust)
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_eb_abbrev :: "e \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> e" ("_[_::=_]\<^sub>e\<^sub>b" [1000,50,50] 500)
   where 
     "e[bv::=b]\<^sub>e\<^sub>b  \<equiv> subst_eb e bv b" 
 
 instantiation e :: has_subst_b
 begin
 definition "subst_b = subst_eb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::e
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof (induct t rule: e.induct)
     case (AE_val v)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
         e.fresh has_subst_b_class.fresh_subst_if subst_b_e_def subst_b_v_def
       by metis
   next
     case (AE_app f v)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def 
         e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def 
-      by (metis (mono_tags, hide_lams) e.fresh(2))
+      by (metis (mono_tags, opaque_lifting) e.fresh(2))
   next
     case (AE_appP f b' v)
     then show ?case unfolding subst_eb.simps   subst_b_e_def e.fresh using
         fresh_def pure_fresh subst_b_e_def e.supp v.supp
         e.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_vb_def   by (metis subst_b_v_def)
   next
     case (AE_op opp v1 v2)
     then show ?case unfolding subst_eb.simps   subst_b_e_def e.fresh using
         fresh_def pure_fresh subst_b_e_def e.supp v.supp fresh_e_opp_all
         e.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_vb_def   by (metis subst_b_v_def)  
   next
     case (AE_concat x1a x2)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
         has_subst_b_class.fresh_subst_if subst_b_v_def 
       by (metis subst_vb.simps(5))
   next
     case (AE_split x1a x2)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  
         has_subst_b_class.fresh_subst_if subst_b_v_def 
       by (metis subst_vb.simps(5))
   next
     case (AE_fst x)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
   next
     case (AE_snd x)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp using  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
   next
     case (AE_mvar x)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp  by auto
   next
     case (AE_len x)
     then show ?case using subst_eb.simps fresh_def pure_fresh subst_b_e_def e.supp v.supp   using  has_subst_b_class.fresh_subst_if subst_b_v_def  by metis
   qed
 
   fix a::bv and tm::e and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
     apply(induct tm rule: e.induct)
              apply( auto simp add: fresh_at_base subst_eb.simps subst_b_e_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.forget_subst subst_b_v_def apply metis+
     done
 
   fix a::bv and tm::e
   show "subst_b tm a (B_var a) = tm" using subst_bb.simps  subst_b_b_def 
     apply (induct tm rule: e.induct)
              apply(auto simp add: fresh_at_base subst_eb.simps subst_b_e_def)
     using has_subst_b_class.fresh_subst_if  subst_b_b_def e.fresh 
     using has_subst_b_class.subst_id subst_b_v_def apply metis+
     done
 
   fix p::perm and x1::bv and v::b and t1::e
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
     apply(induct tm rule: e.induct)
              apply( auto simp add: fresh_at_base subst_bb.simps subst_b_b_def )
     using has_subst_b_class.eqvt  subst_b_b_def e.fresh 
     using has_subst_b_class.eqvt 
     by (simp add: subst_b_e_def)+
 
   fix  bv::bv and c::e and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (induct c rule: e.induct)
              apply(auto simp add: fresh_at_base  subst_eb.simps subst_b_e_def subst_b_v_def  permute_pure pure_supp )
     using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def  subst_b_b_def 
       flip_fresh_fresh subst_b_\<tau>_def apply metis
     apply (metis (full_types) opp.perm_simps  opp.strong_exhaust)
     done
 
   fix bv::bv and c::e and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     apply (induct c rule: e.induct)
              apply(auto simp add: fresh_at_base  subst_eb.simps subst_b_e_def subst_b_v_def  permute_pure pure_supp )
     using  flip_fresh_fresh permute_flip_cancel2 has_subst_b_class.flip_subst subst_b_v_def  subst_b_b_def 
       flip_fresh_fresh subst_b_\<tau>_def apply simp
 
     apply (metis (full_types) opp.perm_simps  opp.strong_exhaust)
     done
 qed
 end
 
 section \<open>Statements\<close>
 
 nominal_function (default "case_sum (\<lambda>x. Inl undefined) (case_sum (\<lambda>x. Inl undefined) (\<lambda>x. Inr undefined))")
   subst_sb :: "s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> s"
   and subst_branchb :: "branch_s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> branch_s" 
   and subst_branchlb :: "branch_list \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> branch_list"
   where
     "subst_sb (AS_val v') bv b         = (AS_val (subst_vb v' bv b))"
   | "subst_sb  (AS_let y  e s)  bv b   = (AS_let y  (e[bv::=b]\<^sub>e\<^sub>b) (subst_sb s bv b ))"  
   | "subst_sb (AS_let2 y t s1 s2) bv b = (AS_let2 y (subst_tb t bv b) (subst_sb s1 bv b ) (subst_sb s2 bv b))"  
   | "subst_sb (AS_match v'  cs) bv b   = AS_match  (subst_vb v' bv b)  (subst_branchlb cs bv b)"
   | "subst_sb  (AS_assign y v') bv b   = AS_assign y (subst_vb v' bv b)"
   | "subst_sb  (AS_if v' s1 s2) bv b   = (AS_if (subst_vb v' bv b) (subst_sb s1 bv b ) (subst_sb s2 bv b ) )"  
   | "subst_sb  (AS_var u \<tau> v' s) bv b  = AS_var u (subst_tb  \<tau> bv b)  (subst_vb v' bv b) (subst_sb s bv b )"
   | "subst_sb  (AS_while s1 s2) bv b   = AS_while (subst_sb s1 bv b  ) (subst_sb s2 bv b )"
   | "subst_sb  (AS_seq s1 s2)  bv b    = AS_seq (subst_sb s1 bv b ) (subst_sb s2 bv b )"
   | "subst_sb  (AS_assert c s)  bv b   = AS_assert (subst_cb c bv b ) (subst_sb s bv b )"
 
 | "subst_branchb (AS_branch dc x1 s') bv b = AS_branch dc x1 (subst_sb s' bv b)"
 
 | "subst_branchlb  (AS_final sb)  bv b     = AS_final (subst_branchb sb bv b )"
 | "subst_branchlb  (AS_cons sb ssb) bv b   = AS_cons (subst_branchb sb bv b) (subst_branchlb ssb bv b)"
 
                       apply (simp add: eqvt_def subst_sb_subst_branchb_subst_branchlb_graph_aux_def )                    
                       apply (auto,metis s_branch_s_branch_list.exhaust s_branch_s_branch_list.exhaust(2) old.sum.exhaust surj_pair)
 
 proof(goal_cases)
 
   have eqvt_at_proj: "\<And> s xa va . eqvt_at subst_sb_subst_branchb_subst_branchlb_sumC (Inl (s, xa, va)) \<Longrightarrow> 
            eqvt_at (\<lambda>a. projl (subst_sb_subst_branchb_subst_branchlb_sumC (Inl a))) (s, xa, va)"
     apply(simp only: eqvt_at_def)
     apply(rule)
     apply(subst Projl_permute)
      apply(thin_tac _)+
      apply(simp add: subst_sb_subst_branchb_subst_branchlb_sumC_def)
      apply(simp add: THE_default_def)
      apply(case_tac "Ex1 (subst_sb_subst_branchb_subst_branchlb_graph (Inl (s,xa,va)))")
       apply simp
       apply(auto)[1]
       apply(erule_tac x="x" in allE)
       apply simp
       apply(cases rule: subst_sb_subst_branchb_subst_branchlb_graph.cases)    
                    apply(assumption)
                   apply(rule_tac x="Sum_Type.projl x" in exI,clarify,rule the1_equality,blast,simp (no_asm) only: sum.sel)+
         apply(blast)+
     apply(simp)+      
     done
   {
     case (1 y s bv b ya sa c)
     moreover have  "atom y \<sharp> (bv, b) \<and> atom ya \<sharp> (bv, b)" using x_fresh_b x_fresh_bv fresh_Pair by simp  
     ultimately show ?case 
       using eqvt_triple eqvt_at_proj by metis
   next
     case (2 y s1 s2 bv b ya s2a c)
     moreover have  "atom y \<sharp> (bv, b) \<and> atom ya \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
     ultimately show ?case 
       using eqvt_triple eqvt_at_proj by metis
   next
     case (3 u s bv b ua sa c)
     moreover have  "atom u \<sharp> (bv, b) \<and> atom ua \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
     ultimately show ?case using eqvt_triple eqvt_at_proj by metis
   next
     case (4 x1 s' bv b x1a s'a c)
     moreover have  "atom x1 \<sharp> (bv, b) \<and> atom x1a \<sharp> (bv, b)" using x_fresh_b x_fresh_bv   fresh_Pair by simp
     ultimately show ?case using eqvt_triple eqvt_at_proj by metis
   }
 qed
 
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_sb_abbrev :: "s \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> s" ("_[_::=_]\<^sub>s\<^sub>b" [1000,50,50] 1000)
   where 
     "b[bv::=b']\<^sub>s\<^sub>b  \<equiv> subst_sb b bv b'" 
 
 lemma fresh_subst_sb_if [simp]: 
   "(j \<sharp> (subst_sb A i x  ))  = ((atom i \<sharp> A \<and> j \<sharp> A) \<or> (j \<sharp> x \<and> (j \<sharp> A \<or> j = atom i)))" and
   "(j \<sharp> (subst_branchb B i x  ))  = ((atom i \<sharp> B \<and> j \<sharp> B) \<or> (j \<sharp> x \<and> (j \<sharp> B \<or> j = atom i)))"  and
   "(j \<sharp> (subst_branchlb C i x  ))  = ((atom i \<sharp> C \<and> j \<sharp> C) \<or> (j \<sharp> x \<and> (j \<sharp> C \<or> j = atom i)))"  
 proof (nominal_induct A and B and C avoiding: i x rule: s_branch_s_branch_list.strong_induct)
   case (AS_branch x1 x2 x3)
   have " (j \<sharp> subst_branchb (AS_branch x1 x2 x3) i x ) =  (j \<sharp> (AS_branch x1 x2 (subst_sb x3 i x)))" by auto
   also have "... = ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1)" using s_branch_s_branch_list.fresh by auto
   also have "...  = ((atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3) \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"  
     using subst_branchb.simps(1) s_branch_s_branch_list.fresh(1)  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_\<tau>_def 
       v.fresh AS_branch
   proof -
     have f1: "\<forall>cs b. atom (b::bv) \<sharp> (cs::char list)" using pure_fresh by auto
 
     then have "j \<sharp> x \<and> atom i = j \<longrightarrow> ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1) = (atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3 \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"
       by (metis (full_types) AS_branch.hyps(3))
     then have "j \<sharp> x \<longrightarrow> ((j \<sharp> x3[i::=x]\<^sub>s\<^sub>b \<or> j \<in> set [atom x2]) \<and> j \<sharp> x1) = (atom i \<sharp> AS_branch x1 x2 x3 \<and> j \<sharp> AS_branch x1 x2 x3 \<or> j \<sharp> x \<and> (j \<sharp> AS_branch x1 x2 x3 \<or> j = atom i))"
       using  AS_branch.hyps s_branch_s_branch_list.fresh by metis
     moreover
     { assume "\<not> j \<sharp> x"
       have ?thesis
         using f1 AS_branch.hyps(2) AS_branch.hyps(3) by force  }
     ultimately show ?thesis
       by satx 
   qed   
   finally show ?case by auto  
 next
   case (AS_cons cs css i x)
   show ?case 
     unfolding subst_branchlb.simps s_branch_s_branch_list.fresh 
     using AS_cons by auto
 next
   case (AS_val xx)
   then show ?case using  subst_sb.simps(1) s_branch_s_branch_list.fresh has_subst_b_class.fresh_subst_if subst_b_b_def subst_b_v_def by metis
 next
   case (AS_let x1 x2 x3)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_e_def 
     by fastforce
 next
   case (AS_let2 x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_\<tau>_def
     by fastforce
 next
   case (AS_if x1 x2 x3)
   then show ?case unfolding   subst_sb.simps s_branch_s_branch_list.fresh using
       has_subst_b_class.fresh_subst_if  subst_b_v_def   by metis
 next
   case (AS_var u t v s)
 
   have "(((atom i \<sharp> s \<and> j \<sharp> s \<or> j \<sharp> x \<and> (j \<sharp> s \<or> j = atom i)) \<or> j \<in> set [atom u]) \<and> j \<sharp> t[i::=x]\<^sub>\<tau>\<^sub>b \<and> j \<sharp> v[i::=x]\<^sub>v\<^sub>b) = 
           (((atom i \<sharp> s \<and> j \<sharp> s \<or> j \<sharp> x \<and> (j \<sharp> s \<or> j = atom i)) \<or> j \<in> set [atom u]) \<and> 
                     ((atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))) \<and>
                     ((atom i \<sharp> v \<and> j \<sharp> v \<or> j \<sharp> x \<and> (j \<sharp> v \<or> j = atom i))))" 
     using    has_subst_b_class.fresh_subst_if  subst_b_v_def  subst_b_\<tau>_def by metis
   also have "... =  (((atom i \<sharp> s \<or> atom i \<in> set [atom u]) \<and> atom i \<sharp> t \<and> atom i \<sharp> v) \<and> 
                (j \<sharp> s \<or> j \<in> set [atom u]) \<and> j \<sharp> t \<and> j \<sharp> v \<or> j \<sharp> x \<and> ((j \<sharp> s \<or> j \<in> set [atom u]) \<and> j \<sharp> t \<and> j \<sharp> v \<or> j = atom i))" 
     using u_fresh_b by auto
   finally show ?case using  subst_sb.simps s_branch_s_branch_list.fresh AS_var 
     by simp
 next
   case (AS_assign u v )
   then show ?case unfolding   subst_sb.simps s_branch_s_branch_list.fresh using
       has_subst_b_class.fresh_subst_if  subst_b_v_def by force
 next
   case (AS_match v cs)
   have " j \<sharp> (AS_match v cs)[i::=x]\<^sub>s\<^sub>b = j \<sharp> (AS_match (subst_vb v i x) (subst_branchlb cs i x ))" using subst_sb.simps by auto
   also have "... = (j \<sharp> (subst_vb v i x) \<and> j \<sharp> (subst_branchlb cs i x ))" using s_branch_s_branch_list.fresh by simp
   also have "... = (j \<sharp> (subst_vb v i x) \<and> ((atom i \<sharp> cs \<and> j \<sharp> cs) \<or> j \<sharp> x \<and> (j \<sharp> cs \<or> j = atom i)))" using  AS_match[of i x] by auto
   also have "... =  (atom i \<sharp> AS_match v cs \<and> j \<sharp> AS_match v cs \<or> j \<sharp> x \<and> (j \<sharp> AS_match v cs \<or> j = atom i))" 
     by (metis (no_types) s_branch_s_branch_list.fresh has_subst_b_class.fresh_subst_if subst_b_v_def) (* 93 ms *)  
   finally show ?case by auto
 next
   case (AS_while x1 x2)
   then show ?case by auto
 next
   case (AS_seq x1 x2)
   then show ?case by auto
 next
   case (AS_assert x1 x2)
   then show ?case unfolding subst_sb.simps  s_branch_s_branch_list.fresh 
     using  fresh_at_base has_subst_b_class.fresh_subst_if list.distinct list.set_cases set_ConsD subst_b_e_def 
     by (metis subst_b_c_def)   
 qed(auto+)
 
 lemma 
   forget_subst_sb[simp]: "atom a \<sharp> A \<Longrightarrow> subst_sb A a x = A" and
   forget_subst_branchb [simp]: "atom a \<sharp> B \<Longrightarrow> subst_branchb B a x = B" and 
   forget_subst_branchlb[simp]: "atom a \<sharp> C \<Longrightarrow> subst_branchlb C a x = C"
 proof (nominal_induct A and B and C avoiding: a x rule: s_branch_s_branch_list.strong_induct)
   case (AS_let x1 x2 x3)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_let2 x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_\<tau>_def by force
 next
   case (AS_var x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def  using subst_b_\<tau>_def 
   proof -
     have f1: "(atom a \<sharp> x4 \<or> atom a \<in> set [atom x1]) \<and> atom a \<sharp> x2 \<and> atom a \<sharp> x3"
       using AS_var.prems s_branch_s_branch_list.fresh  by simp
     then have "atom a \<sharp> x4"
       by (metis (no_types) "Nominal-Utils.fresh_star_singleton" AS_var.hyps(1) empty_set fresh_star_def list.simps(15) not_self_fresh) (* 46 ms *)
     then show ?thesis
       using f1 by (metis AS_var.hyps(3) has_subst_b_class.forget_subst subst_b_\<tau>_def subst_b_v_def subst_sb.simps(7)) (* 62 ms *)
   qed
 next
   case (AS_branch x1 x2 x3)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_cons x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_val x)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_if x1 x2 x3)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_assign x1 x2)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_match x1 x2)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_while x1 x2)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_seq x1 x2)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def by force
 next
   case (AS_assert c s)
   then show ?case unfolding  subst_sb.simps using
       s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.forget_subst subst_b_v_def  subst_b_c_def subst_cb.simps  by force
 qed(auto+)
 
 lemma   subst_sb_id: "subst_sb A a (B_var a) = A" and
   subst_branchb_id [simp]: "subst_branchb B a (B_var a) = B" and
   subst_branchlb_id: "subst_branchlb C a (B_var a) = C"
 proof(nominal_induct A and B and C avoiding: a  rule: s_branch_s_branch_list.strong_induct)
   case (AS_branch x1 x2 x3)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def 
     by simp
 next
   case (AS_cons x1 x2 )
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by simp
 next
   case (AS_val x)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_if x1 x2 x3)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_assign x1 x2)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_match x1 x2)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_while x1 x2)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_seq x1 x2)
   then show ?case  using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_let x1 x2 x3)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_e_def has_subst_b_class.subst_id by metis
 next
   case (AS_let2 x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id by metis
 next
   case (AS_var x1 x2 x3 x4)
   then show ?case using subst_sb.simps s_branch_s_branch_list.fresh subst_b_\<tau>_def has_subst_b_class.subst_id subst_b_v_def by metis
 next
   case (AS_assert c s )
   then show ?case unfolding subst_sb.simps using s_branch_s_branch_list.fresh subst_b_c_def has_subst_b_class.subst_id by metis
 qed (auto)
 
 lemma flip_subst_s:
   fixes  bv::bv and s::s and cs::branch_s and z::bv
   shows   "atom bv \<sharp> s \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> s) = s[z::=B_var bv]\<^sub>s\<^sub>b"  and
     "atom bv \<sharp> cs \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> cs) = subst_branchb  cs z (B_var bv) " and
     "atom bv \<sharp> css \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> css) = subst_branchlb css z (B_var bv) "
 
 proof(nominal_induct s and cs and css  rule: s_branch_s_branch_list.strong_induct)
   case (AS_branch x1 x2 x3)
   hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1"  using pure_fresh fresh_at_base flip_fresh_fresh  by metis
   moreover have "((bv \<leftrightarrow> z) \<bullet> x2) = x2" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_branch  by auto
   ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_branch by auto
 next
   case (AS_cons x1 x2 )
   hence "((bv \<leftrightarrow> z) \<bullet> x1) =  subst_branchb x1 z (B_var bv)"  using pure_fresh fresh_at_base flip_fresh_fresh  s_branch_s_branch_list.fresh(13)  by metis
   moreover have "((bv \<leftrightarrow> z) \<bullet> x2) =  subst_branchlb x2 z (B_var bv)" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_cons s_branch_s_branch_list.fresh by metis
   ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_cons by auto
 next
   case (AS_val x)
   then show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using flip_subst subst_b_v_def by simp
 next
   case (AS_let x1 x2 x3)
   moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
   ultimately show ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def s_branch_s_branch_list.fresh by auto 
 next
   case (AS_let2 x1 x2 x3 x4)
   moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
   ultimately show ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst s_branch_s_branch_list.fresh(5) subst_b_\<tau>_def by auto
 next
   case (AS_if x1 x2 x3) 
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_var x1 x2 x3 x4)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def subst_b_\<tau>_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
 next
   case (AS_assign x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
 next
   case (AS_match x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_while x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_seq x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_assert x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_c_def subst_b_v_def s_branch_s_branch_list.fresh by simp
 qed(auto)
 
 lemma flip_subst_subst_s:
   fixes  bv::bv and s::s and cs::branch_s and z::bv
   shows   "atom bv \<sharp> s \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> s)[bv::=v]\<^sub>s\<^sub>b = s[z::=v]\<^sub>s\<^sub>b"    and
     "atom bv \<sharp> cs \<Longrightarrow> subst_branchb ((bv \<leftrightarrow> z) \<bullet> cs) bv v = subst_branchb cs z v" and
     "atom bv \<sharp> css \<Longrightarrow> subst_branchlb ((bv \<leftrightarrow> z) \<bullet> css) bv v = subst_branchlb  css z v " 
 proof(nominal_induct s  and cs and css rule: s_branch_s_branch_list.strong_induct)
   case (AS_branch x1 x2 x3)
   hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1"  using pure_fresh fresh_at_base flip_fresh_fresh  by metis
   moreover have "((bv \<leftrightarrow> z) \<bullet> x2) = x2" using  fresh_at_base flip_fresh_fresh[of bv x2 z] AS_branch  by auto
   ultimately show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using s_branch_s_branch_list.fresh(1) AS_branch by auto
 next
   case (AS_cons x1 x2 )
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_branchlb.simps
     using s_branch_s_branch_list.fresh(1) AS_cons by auto
 
 next
   case (AS_val x)
   then show ?case unfolding  s_branch_s_branch_list.perm_simps subst_branchb.simps using flip_subst subst_b_v_def by simp
 next
   case (AS_let x1 x2 x3)
   moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
   ultimately show ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst_subst subst_b_e_def s_branch_s_branch_list.fresh by force
 next
   case (AS_let2 x1 x2 x3 x4)
   moreover hence "((bv \<leftrightarrow> z) \<bullet> x1) = x1" using fresh_at_base flip_fresh_fresh[of bv x1 z]  by auto
   ultimately show ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst s_branch_s_branch_list.fresh(5) subst_b_\<tau>_def by auto
 next
   case (AS_if x1 x2 x3) 
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_var x1 x2 x3 x4)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def subst_b_\<tau>_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
 next
   case (AS_assign x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh fresh_at_base flip_fresh_fresh[of bv x1 z] by auto
 next
   case (AS_match x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_while x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_seq x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_v_def s_branch_s_branch_list.fresh by auto
 next
   case (AS_assert x1 x2)
   thus ?case 
     unfolding  s_branch_s_branch_list.perm_simps subst_sb.simps 
     using flip_subst subst_b_e_def subst_b_c_def s_branch_s_branch_list.fresh by auto
 qed(auto)
 
 instantiation s :: has_subst_b
 begin
 definition "subst_b = (\<lambda>s bv b. subst_sb s bv b)"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::s
   show  "j \<sharp> subst_b t i x = ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i)))" 
     using fresh_subst_sb_if subst_b_s_def by metis
 
   fix a::bv and tm::s and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm" using subst_b_s_def forget_subst_sb by metis
 
   fix a::bv and tm::s
   show "subst_b tm a (B_var a) = tm" using subst_b_s_def  subst_sb_id   by metis
 
   fix p::perm and x1::bv and v::b and t1::s
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" using subst_b_s_def subst_sb_subst_branchb_subst_branchlb.eqvt by metis
 
   fix  bv::bv and c::s and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     using subst_b_s_def flip_subst_s by metis
 
   fix bv::bv and c::s and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     using flip_subst_subst_s subst_b_s_def by metis
 qed
 end
 
 section \<open>Function Type\<close>
 
 nominal_function subst_ft_b :: "fun_typ \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> fun_typ" where
   "subst_ft_b ( AF_fun_typ z b c t (s::s)) x v = AF_fun_typ z (subst_bb b x v) (subst_cb c x v) t[x::=v]\<^sub>\<tau>\<^sub>b s[x::=v]\<^sub>s\<^sub>b"
      apply(simp add: eqvt_def subst_ft_b_graph_aux_def )
     apply(simp add:fun_typ.strong_exhaust,auto )
   apply(rule_tac y=a and c="(a,b)" in fun_typ.strong_exhaust)
   apply (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
   done
 
 nominal_termination (eqvt) by lexicographic_order
 
 nominal_function subst_ftq_b :: "fun_typ_q \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> fun_typ_q" where
   "atom bv \<sharp> (x,v) \<Longrightarrow>  subst_ftq_b (AF_fun_typ_some bv ft) x v = (AF_fun_typ_some bv (subst_ft_b ft x v))" 
 |  "subst_ftq_b (AF_fun_typ_none  ft) x v = (AF_fun_typ_none (subst_ft_b ft x v))" 
        apply(simp add: eqvt_def subst_ftq_b_graph_aux_def )
       apply(simp add:fun_typ_q.strong_exhaust,auto )
   apply(rule_tac y=a and c="(aa,b)" in fun_typ_q.strong_exhaust)
   by (auto simp: eqvt_at_def fresh_star_def fresh_Pair fresh_at_base)
 nominal_termination (eqvt) by lexicographic_order
 
 instantiation fun_typ :: has_subst_b
 begin
 definition "subst_b = subst_ft_b"
 
 text \<open>Note: Using just simp in the second apply unpacks and gives a single goal
 whereas auto gives 43 non-intuitive goals. These goals are easier to solve 
 and tedious, however they that it clear if a mistake is made in the definition of the function. 
 For example, I saw that one of the goals was 
 going through with metis and the next wasn't. 
 It turned out the definition of the function itself was wrong\<close>
 
 instance proof
   fix j::atom and i::bv and  x::b and t::fun_typ
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
     apply(nominal_induct t avoiding: i x rule:fun_typ.strong_induct)
     apply(auto simp add: subst_b_fun_typ_def )       
     by(metis fresh_subst_if subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def)+
 
   fix a::bv and tm::fun_typ and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x  = tm"
     apply (nominal_induct tm avoiding: a x rule: fun_typ.strong_induct)
     apply(simp add: subst_b_fun_typ_def Abs1_eq_iff')
     using subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
       forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
       subst_ft_b.simps  by metis
 
   fix a::bv and tm::fun_typ
   show "subst_b tm a (B_var a) = tm" 
     apply (nominal_induct tm rule: fun_typ.strong_induct)
     apply(simp add: subst_b_fun_typ_def Abs1_eq_iff',auto)
     using subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
       forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
       subst_ft_b.simps 
     by (metis has_subst_b_class.subst_id)+
 
   fix p::perm and x1::bv and v::b and t1::fun_typ
   show "p \<bullet> subst_b t1 x1 v = subst_b (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v) " 
     apply (nominal_induct t1 avoiding: x1 v rule: fun_typ.strong_induct)
     by(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps)
 
   fix  bv::bv and c::fun_typ and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (nominal_induct c avoiding: z bv rule: fun_typ.strong_induct)
     by(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def)
 
   fix bv::bv and c::fun_typ and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     apply (nominal_induct c avoiding:  bv v z rule: fun_typ.strong_induct)
     apply(auto simp add: subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def flip_subst_subst flip_subst)
     using  subst_b_fun_typ_def Abs1_eq_iff' fun_typ.perm_simps subst_b_b_def subst_b_c_def  subst_b_\<tau>_def  subst_b_s_def flip_subst_subst flip_subst 
     using flip_subst_s(1) flip_subst_subst_s(1) by auto
 qed
 end
 
 instantiation fun_typ_q :: has_subst_b
 begin
 definition "subst_b = subst_ftq_b"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::fun_typ_q
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
     apply (nominal_induct t avoiding: i x j rule: fun_typ_q.strong_induct,auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps)
     using  fresh_subst_if subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def apply metis+
     done
 
   fix a::bv and t::fun_typ_q and x::b
   show "atom a \<sharp> t \<Longrightarrow> subst_b t a x  = t"
     apply (nominal_induct t avoiding: a x  rule: fun_typ_q.strong_induct)
      apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
     using  forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
 
   fix p::perm and x1::bv and v::b and t::fun_typ_q
   show "p \<bullet> subst_b t x1 v = subst_b (p \<bullet> t) (p \<bullet> x1) (p \<bullet> v) " 
     apply (nominal_induct t avoiding: x1 v  rule: fun_typ_q.strong_induct)
     by(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
 
   fix a::bv and tm::fun_typ_q
   show "subst_b tm a (B_var a) = tm" 
     apply (nominal_induct tm avoiding: a rule: fun_typ_q.strong_induct)
      apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff')
     using subst_id subst_b_b_def  subst_b_fun_typ_def subst_b_\<tau>_def subst_b_c_def subst_b_s_def
       forget_subst fresh_at_base list.set_cases neq_Nil_conv set_ConsD
       subst_ft_b.simps by metis+
 
   fix  bv::bv and c::fun_typ_q and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
     apply (nominal_induct c avoiding: z bv  rule: fun_typ_q.strong_induct)
      apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
     using  forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
 
   fix bv::bv and c::fun_typ_q and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
     apply (nominal_induct c avoiding: z v bv  rule: fun_typ_q.strong_induct)
      apply(auto simp add: subst_b_fun_typ_q_def subst_ftq_b.simps Abs1_eq_iff') 
     using  flip_subst flip_subst_subst forget_subst subst_b_fun_typ_q_def subst_b_s_def subst_b_\<tau>_def subst_b_b_def subst_b_c_def subst_b_fun_typ_def eqvt by metis+
 
 qed
 end
 
 section \<open>Contexts\<close>
 
 subsection \<open>Immutable Variables\<close>
 nominal_function subst_gb :: "\<Gamma> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Gamma>" where
   "subst_gb GNil _ _  = GNil"
 | "subst_gb ((y,b',c)#\<^sub>\<Gamma>\<Gamma>) bv b = ((y,b'[bv::=b]\<^sub>b\<^sub>b,c[bv::=b]\<^sub>c\<^sub>b)#\<^sub>\<Gamma> (subst_gb \<Gamma> bv b))"
        apply (simp add: eqvt_def subst_gb_graph_aux_def )+
      apply auto
   apply (insert \<Gamma>.exhaust neq_GNil_conv, force)
   done
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_gb_abbrev :: "\<Gamma> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Gamma>" ("_[_::=_]\<^sub>\<Gamma>\<^sub>b" [1000,50,50] 1000)
   where 
     "g[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<equiv> subst_gb g bv b'" 
 
 instantiation \<Gamma> :: has_subst_b
 begin
 definition "subst_b = subst_gb"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::\<Gamma>
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof(induct t rule: \<Gamma>_induct)
     case GNil
     then show ?case using fresh_GNil  subst_gb.simps  fresh_def pure_fresh subst_b_\<Gamma>_def has_subst_b_class.fresh_subst_if fresh_GNil fresh_GCons by metis
   next
     case (GCons x' b' c' \<Gamma>')
     have *: "atom i \<sharp> x' " using  fresh_at_base by simp
 
     have "j \<sharp> subst_b ((x', b', c') #\<^sub>\<Gamma> \<Gamma>') i x = j \<sharp> ((x', b'[i::=x]\<^sub>b\<^sub>b, c'[i::=x]\<^sub>c\<^sub>b) #\<^sub>\<Gamma> (subst_b \<Gamma>' i x))" using subst_gb.simps  subst_b_\<Gamma>_def by auto
     also have "... = (j \<sharp> ((x', b'[i::=x]\<^sub>b\<^sub>b, c'[i::=x]\<^sub>c\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))" using fresh_GCons by auto
     also have "... = (((j  \<sharp> x') \<and> (j  \<sharp> b'[i::=x]\<^sub>b\<^sub>b) \<and> (j  \<sharp> c'[i::=x]\<^sub>c\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))"  by auto
     also have "... = (((j  \<sharp> x') \<and> ((atom i \<sharp> b' \<and> j \<sharp> b' \<or> j \<sharp> x \<and> (j \<sharp> b' \<or> j = atom i))) \<and> 
                                    ((atom i \<sharp> c' \<and> j \<sharp> c' \<or> j \<sharp> x \<and> (j \<sharp> c' \<or> j = atom i))) \<and> 
                                    ((atom i \<sharp> \<Gamma>' \<and> j \<sharp> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> \<Gamma>' \<or> j = atom i)))))" 
       using fresh_subst_if[of j b' i x] fresh_subst_if[of j c' i x] GCons subst_b_b_def  subst_b_c_def  by simp
     also have "... = ((atom i \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>' \<and> j \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>') \<or> (j \<sharp> x \<and> (j \<sharp> (x', b', c') #\<^sub>\<Gamma> \<Gamma>' \<or> j = atom i)))" using * fresh_GCons fresh_prod3 by metis
 
     finally show ?case  by auto
   qed
 
   fix a::bv and tm::\<Gamma> and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
   proof (induct tm rule: \<Gamma>_induct)
     case GNil
     then show ?case using  subst_gb.simps subst_b_\<Gamma>_def by auto
   next
     case (GCons x' b' c' \<Gamma>')
     have *:"b'[a::=x]\<^sub>b\<^sub>b = b' \<and> c'[a::=x]\<^sub>c\<^sub>b = c'" using GCons fresh_GCons[of "atom a"] fresh_prod3[of "atom a"] has_subst_b_class.forget_subst  subst_b_b_def subst_b_c_def by metis
     have "subst_b ((x', b', c') #\<^sub>\<Gamma> \<Gamma>') a x = ((x', b'[a::=x]\<^sub>b\<^sub>b, c'[a::=x]\<^sub>c\<^sub>b) #\<^sub>\<Gamma> (subst_b \<Gamma>' a x))" using  subst_b_\<Gamma>_def subst_gb.simps by auto
     also have "... = ((x', b', c') #\<^sub>\<Gamma> \<Gamma>')" using * GCons  fresh_GCons[of "atom a"]  by auto 
     finally show ?case using   has_subst_b_class.forget_subst fresh_GCons fresh_prod3 GCons subst_b_\<Gamma>_def has_subst_b_class.forget_subst[of a b' x] fresh_prod3[of "atom a"] by argo
   qed
 
   fix a::bv and tm::\<Gamma>
   show "subst_b tm a (B_var a) = tm"
   proof(induct tm rule: \<Gamma>_induct)
     case GNil
     then show ?case using  subst_gb.simps subst_b_\<Gamma>_def by auto
   next
     case (GCons x' b' c' \<Gamma>')
     then show ?case using    has_subst_b_class.subst_id  subst_b_\<Gamma>_def subst_b_b_def subst_b_c_def subst_gb.simps by metis
   qed
 
   fix p::perm and x1::bv and v::b and t1::\<Gamma>
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
   proof (induct tm rule: \<Gamma>_induct)
     case GNil
     then show ?case using subst_b_\<Gamma>_def subst_gb.simps by simp
   next
     case (GCons x' b' c' \<Gamma>')
     then show ?case using subst_b_\<Gamma>_def subst_gb.simps has_subst_b_class.eqvt by argo
   qed
 
   fix  bv::bv and c::\<Gamma> and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
   proof (induct c rule: \<Gamma>_induct)
     case GNil
     then show ?case using subst_b_\<Gamma>_def subst_gb.simps by auto
   next
     case (GCons x b c \<Gamma>')   
     have *:"(bv \<leftrightarrow> z) \<bullet> (x, b, c) = (x, (bv \<leftrightarrow> z) \<bullet> b, (bv \<leftrightarrow> z) \<bullet> c)" using flip_bv_x_cancel by auto
     then show ?case 
       unfolding subst_gb.simps subst_b_\<Gamma>_def permute_\<Gamma>.simps  * 
       using GCons subst_b_\<Gamma>_def subst_gb.simps flip_subst subst_b_b_def subst_b_c_def fresh_GCons by auto
   qed
 
   fix bv::bv and c::\<Gamma> and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
   proof (induct c rule: \<Gamma>_induct)
     case GNil
     then show ?case using subst_b_\<Gamma>_def subst_gb.simps by auto
   next
     case (GCons x b c \<Gamma>')   
     have *:"(bv \<leftrightarrow> z) \<bullet> (x, b, c) = (x, (bv \<leftrightarrow> z) \<bullet> b, (bv \<leftrightarrow> z) \<bullet> c)" using flip_bv_x_cancel by auto
     then show ?case 
       unfolding subst_gb.simps subst_b_\<Gamma>_def permute_\<Gamma>.simps  * 
       using GCons subst_b_\<Gamma>_def subst_gb.simps flip_subst subst_b_b_def subst_b_c_def fresh_GCons by auto
   qed
 qed
 end
 
 lemma subst_b_base_for_lit:
   "(base_for_lit l)[bv::=b]\<^sub>b\<^sub>b = base_for_lit l"
   using base_for_lit.simps l.strong_exhaust 
   by (metis subst_bb.simps(2) subst_bb.simps(3) subst_bb.simps(6) subst_bb.simps(7))
 
 lemma subst_b_lookup:
   assumes "Some (b, c) = lookup \<Gamma> x"
   shows " Some (b[bv::=b']\<^sub>b\<^sub>b, c[bv::=b']\<^sub>c\<^sub>b) = lookup \<Gamma>[bv::=b']\<^sub>\<Gamma>\<^sub>b x"
   using assms by(induct \<Gamma> rule: \<Gamma>_induct, auto)
 
 lemma subst_g_b_x_fresh:
   fixes x::x and b::b and \<Gamma>::\<Gamma> and bv::bv
   assumes "atom x \<sharp> \<Gamma>"
   shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b"
   using subst_b_fresh_x subst_b_\<Gamma>_def assms by metis
 
 subsection \<open>Mutable Variables\<close>
 
 nominal_function subst_db :: "\<Delta> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Delta>" where
   "subst_db []\<^sub>\<Delta> _ _  = []\<^sub>\<Delta>"
 | "subst_db  ((u,t) #\<^sub>\<Delta> \<Delta>) bv b = ((u,t[bv::=b]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_db \<Delta> bv b))"
        apply (simp add: eqvt_def subst_db_graph_aux_def,auto )
   using list.exhaust delete_aux.elims
   using neq_DNil_conv by fastforce
 nominal_termination (eqvt) by lexicographic_order
 
 abbreviation 
   subst_db_abbrev :: "\<Delta> \<Rightarrow> bv \<Rightarrow> b \<Rightarrow> \<Delta>" ("_[_::=_]\<^sub>\<Delta>\<^sub>b" [1000,50,50] 1000)
   where 
     "\<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b  \<equiv> subst_db \<Delta> bv b" 
 
 instantiation \<Delta> :: has_subst_b
 begin
 definition "subst_b = subst_db"
 
 instance proof
   fix j::atom and i::bv and  x::b and t::\<Delta>
   show  "j \<sharp> subst_b t i x = (atom i \<sharp> t \<and> j \<sharp> t \<or> j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))"
   proof(induct t rule: \<Delta>_induct)
     case DNil
     then show ?case using fresh_DNil  subst_db.simps  fresh_def pure_fresh subst_b_\<Delta>_def has_subst_b_class.fresh_subst_if fresh_DNil fresh_DCons by metis
   next
     case (DCons u t \<Gamma>')
     have "j \<sharp> subst_b ((u, t) #\<^sub>\<Delta> \<Gamma>') i x = j \<sharp> ((u, t[i::=x]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_b \<Gamma>' i x))" using subst_db.simps  subst_b_\<Delta>_def by auto
     also have "... = (j \<sharp> ((u, t[i::=x]\<^sub>\<tau>\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))" using fresh_DCons by auto
     also have "... = (((j  \<sharp> u) \<and> (j  \<sharp> t[i::=x]\<^sub>\<tau>\<^sub>b)) \<and> (j \<sharp>  (subst_b \<Gamma>' i x)))"  by auto
     also have "... =   ((j  \<sharp> u) \<and>  ((atom i \<sharp> t \<and> j \<sharp> t) \<or> (j \<sharp> x \<and> (j \<sharp> t \<or> j = atom i))) \<and> (atom i \<sharp> \<Gamma>' \<and> j \<sharp> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> \<Gamma>' \<or> j = atom i)))" 
       using has_subst_b_class.fresh_subst_if[of j t i x] subst_b_\<tau>_def DCons  subst_b_\<Delta>_def by auto
     also have "... = (atom i \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<and> j \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<or> j \<sharp> x \<and> (j \<sharp> (u, t) #\<^sub>\<Delta> \<Gamma>' \<or> j = atom i))" 
       using DCons subst_db.simps(2)  has_subst_b_class.fresh_subst_if fresh_DCons subst_b_\<Delta>_def  pure_fresh fresh_at_base by auto
     finally show ?case  by auto
   qed
 
   fix a::bv and tm::\<Delta> and x::b
   show "atom a \<sharp> tm \<Longrightarrow> subst_b tm a x = tm"
   proof (induct tm rule: \<Delta>_induct)
     case DNil
     then show ?case using  subst_db.simps subst_b_\<Delta>_def by auto
   next
     case (DCons u t \<Gamma>')
     have *:"t[a::=x]\<^sub>\<tau>\<^sub>b = t" using DCons fresh_DCons[of "atom a"] fresh_prod2[of "atom a"] has_subst_b_class.forget_subst  subst_b_\<tau>_def by metis
     have "subst_b ((u,t) #\<^sub>\<Delta> \<Gamma>') a x = ((u,t[a::=x]\<^sub>\<tau>\<^sub>b) #\<^sub>\<Delta> (subst_b \<Gamma>' a x))" using  subst_b_\<Delta>_def subst_db.simps by auto
     also have "... = ((u, t) #\<^sub>\<Delta> \<Gamma>')" using * DCons  fresh_DCons[of "atom a"]  by auto 
     finally show ?case using   
         has_subst_b_class.forget_subst fresh_DCons fresh_prod3 
         DCons subst_b_\<Delta>_def has_subst_b_class.forget_subst[of a t x] fresh_prod3[of "atom a"] by argo
   qed
 
   fix a::bv and tm::\<Delta>
   show "subst_b tm a (B_var a) = tm"
   proof(induct tm rule: \<Delta>_induct)
     case DNil
     then show ?case using  subst_db.simps subst_b_\<Delta>_def by auto
   next
     case (DCons u t  \<Gamma>')
     then show ?case using    has_subst_b_class.subst_id  subst_b_\<Delta>_def subst_b_\<tau>_def subst_db.simps by metis
   qed
 
   fix p::perm and x1::bv and v::b and t1::\<Delta>
   show "p \<bullet> subst_b t1 x1 v  = subst_b  (p \<bullet> t1) (p \<bullet> x1) (p \<bullet> v)" 
   proof (induct tm rule: \<Delta>_induct)
     case DNil
     then show ?case using subst_b_\<Delta>_def subst_db.simps by simp
   next
     case (DCons x' b' \<Gamma>')
     then show ?case  by argo
   qed
 
   fix  bv::bv and c::\<Delta> and z::bv
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c) = c[z::=B_var bv]\<^sub>b"
   proof (induct c rule: \<Delta>_induct)
     case DNil
     then show ?case using subst_b_\<Delta>_def subst_db.simps by auto
   next
     case (DCons u t')
     then show ?case 
       unfolding subst_db.simps subst_b_\<Delta>_def permute_\<Delta>.simps  
       using DCons subst_b_\<Delta>_def subst_db.simps flip_subst subst_b_\<tau>_def flip_fresh_fresh fresh_at_base fresh_DCons flip_bv_u_cancel by simp
   qed
 
   fix bv::bv and c::\<Delta> and z::bv and v::b
   show "atom bv \<sharp> c \<Longrightarrow> ((bv \<leftrightarrow> z) \<bullet> c)[bv::=v]\<^sub>b = c[z::=v]\<^sub>b"
   proof (induct c rule: \<Delta>_induct)
     case DNil
     then show ?case using subst_b_\<Delta>_def subst_db.simps by auto
   next
     case (DCons u t')
     then show ?case 
       unfolding subst_db.simps subst_b_\<Delta>_def permute_\<Delta>.simps  
       using DCons subst_b_\<Delta>_def subst_db.simps flip_subst subst_b_\<tau>_def flip_fresh_fresh fresh_at_base fresh_DCons flip_bv_u_cancel by simp
   qed
 qed
 end
 
 lemma subst_d_b_member:
   assumes "(u, \<tau>) \<in> setD \<Delta>" 
   shows  "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
   using assms  by (induct \<Delta>,auto)
 
 lemmas ms_fresh_all = e.fresh s_branch_s_branch_list.fresh \<tau>.fresh c.fresh ce.fresh v.fresh l.fresh fresh_at_base opp.fresh pure_fresh ms_fresh
 
 lemmas fresh_intros[intro] = fresh_GNil x_not_in_b_set x_not_in_u_atoms x_fresh_b u_not_in_x_atoms bv_not_in_x_atoms u_not_in_b_atoms
 
 lemmas subst_b_simps = subst_tb.simps subst_cb.simps subst_ceb.simps subst_vb.simps subst_bb.simps  subst_eb.simps subst_branchb.simps subst_sb.simps
 
 lemma subst_d_b_x_fresh:
   fixes x::x and b::b and \<Delta>::\<Delta> and bv::bv
   assumes "atom x \<sharp> \<Delta>"
   shows  "atom x \<sharp> \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"
   using subst_b_fresh_x subst_b_\<Delta>_def assms by metis
 
 lemma subst_b_fresh_x:
   fixes  x::x
   shows "atom x \<sharp> v \<Longrightarrow> atom x \<sharp> v[bv::=b']\<^sub>v\<^sub>b" and
     "atom x \<sharp> ce \<Longrightarrow> atom x \<sharp> ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b" and
     "atom x \<sharp> e \<Longrightarrow> atom x \<sharp> e[bv::=b']\<^sub>e\<^sub>b" and
     "atom x \<sharp> c \<Longrightarrow> atom x \<sharp> c[bv::=b']\<^sub>c\<^sub>b" and
     "atom x \<sharp> t \<Longrightarrow> atom x \<sharp> t[bv::=b']\<^sub>\<tau>\<^sub>b" and
     "atom x \<sharp> d \<Longrightarrow> atom x \<sharp> d[bv::=b']\<^sub>\<Delta>\<^sub>b" and
     "atom x \<sharp> g \<Longrightarrow> atom x \<sharp> g[bv::=b']\<^sub>\<Gamma>\<^sub>b" and
     "atom x \<sharp> s \<Longrightarrow> atom x \<sharp> s[bv::=b']\<^sub>s\<^sub>b"
   using fresh_subst_if x_fresh_b subst_b_v_def subst_b_ce_def subst_b_e_def subst_b_c_def subst_b_\<tau>_def subst_b_s_def subst_g_b_x_fresh subst_d_b_x_fresh 
   by metis+
 
 lemma subst_b_fresh_u_cls:
   fixes tm::"'a::has_subst_b" and x::u
   shows "atom x \<sharp> tm = atom x \<sharp> tm[bv::=b']\<^sub>b"
   using fresh_subst_if[of "atom x" tm bv b'] using u_fresh_b by auto
 
 lemma subst_g_b_u_fresh:
   fixes x::u and b::b and \<Gamma>::\<Gamma> and bv::bv
   assumes "atom x \<sharp> \<Gamma>"
   shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b"
   using subst_b_fresh_u_cls subst_b_\<Gamma>_def assms by metis
 
 lemma subst_d_b_u_fresh:
   fixes x::u and b::b and \<Gamma>::\<Delta> and bv::bv
   assumes "atom x \<sharp> \<Gamma>"
   shows  "atom x \<sharp> \<Gamma>[bv::=b]\<^sub>\<Delta>\<^sub>b"
   using subst_b_fresh_u_cls subst_b_\<Delta>_def assms by metis
 
 lemma subst_b_fresh_u:
   fixes  x::u
   shows "atom x \<sharp> v \<Longrightarrow> atom x \<sharp> v[bv::=b']\<^sub>v\<^sub>b" and
     "atom x \<sharp> ce \<Longrightarrow> atom x \<sharp> ce[bv::=b']\<^sub>c\<^sub>e\<^sub>b" and
     "atom x \<sharp> e \<Longrightarrow> atom x \<sharp> e[bv::=b']\<^sub>e\<^sub>b" and
     "atom x \<sharp> c \<Longrightarrow> atom x \<sharp> c[bv::=b']\<^sub>c\<^sub>b" and
     "atom x \<sharp> t \<Longrightarrow> atom x \<sharp> t[bv::=b']\<^sub>\<tau>\<^sub>b" and
     "atom x \<sharp> d \<Longrightarrow> atom x \<sharp> d[bv::=b']\<^sub>\<Delta>\<^sub>b" and
     "atom x \<sharp> g \<Longrightarrow> atom x \<sharp> g[bv::=b']\<^sub>\<Gamma>\<^sub>b" and
     "atom x \<sharp> s \<Longrightarrow> atom x \<sharp> s[bv::=b']\<^sub>s\<^sub>b"
   using fresh_subst_if u_fresh_b subst_b_v_def subst_b_ce_def subst_b_e_def subst_b_c_def subst_b_\<tau>_def subst_b_s_def subst_g_b_u_fresh subst_d_b_u_fresh 
   by metis+
 
 lemma subst_db_u_fresh:
   fixes u::u and b::b and D::\<Delta>
   assumes "atom u \<sharp> D"
   shows  "atom u \<sharp> D[bv::=b]\<^sub>\<Delta>\<^sub>b"
   using assms proof(induct D rule: \<Delta>_induct)
   case DNil
   then show ?case by auto
 next
   case (DCons u' t' D')
   then show ?case using subst_db.simps fresh_def fresh_DCons fresh_subst_if subst_b_\<tau>_def 
     by (metis fresh_Pair u_not_in_b_atoms)
 qed
 
 lemma flip_bt_subst4:
   fixes t::\<tau> and bv::bv 
   assumes "atom bv \<sharp> t" 
   shows "t[bv'::=b]\<^sub>\<tau>\<^sub>b = ((bv' \<leftrightarrow> bv) \<bullet> t)[bv::=b]\<^sub>\<tau>\<^sub>b" 
   using flip_subst_subst[OF assms,of bv' b] 
   by (simp add: flip_commute subst_b_\<tau>_def)
 
 lemma subst_bt_flip_sym:
   fixes t1::\<tau> and t2::\<tau>
   assumes "atom bv \<sharp> b" and "atom bv \<sharp> (bv1, bv2, t1, t2)" and "(bv1 \<leftrightarrow> bv) \<bullet> t1 = (bv2 \<leftrightarrow> bv) \<bullet> t2"
   shows " t1[bv1::=b]\<^sub>\<tau>\<^sub>b = t2[bv2::=b]\<^sub>\<tau>\<^sub>b"
   using assms  flip_bt_subst4[of bv t1 bv1 b ]   flip_bt_subst4 fresh_prod4 fresh_Pair by metis
 
 end
\ No newline at end of file
diff --git a/thys/MiniSail/Nominal-Utils.thy b/thys/MiniSail/Nominal-Utils.thy
--- a/thys/MiniSail/Nominal-Utils.thy
+++ b/thys/MiniSail/Nominal-Utils.thy
@@ -1,586 +1,586 @@
 (*<*)
 theory "Nominal-Utils"
 imports Nominal2.Nominal2 "HOL-Library.AList"
 begin
 (*>*)
 
 chapter \<open>Prelude\<close>
 text \<open>Some useful Nominal lemmas. Many of these are from Launchbury.Nominal-Utils.\<close>
 
 section \<open>Lemmas helping with equivariance proofs\<close>
 
 lemma perm_rel_lemma:
   assumes "\<And> \<pi> x y. r (\<pi> \<bullet> x) (\<pi> \<bullet> y) \<Longrightarrow> r x y"
   shows "r (\<pi> \<bullet> x) (\<pi> \<bullet> y) \<longleftrightarrow> r x y" (is "?l \<longleftrightarrow> ?r")
 by (metis (full_types) assms permute_minus_cancel(2))
 
 lemma perm_rel_lemma2:
   assumes "\<And> \<pi> x y. r x y \<Longrightarrow> r (\<pi> \<bullet> x) (\<pi> \<bullet> y)"
   shows "r x y \<longleftrightarrow> r (\<pi> \<bullet> x) (\<pi> \<bullet> y)" (is "?l \<longleftrightarrow> ?r")
 by (metis (full_types) assms permute_minus_cancel(2))
 
 lemma fun_eqvtI:
   assumes f_eqvt[eqvt]: "(\<And> p x. p \<bullet> (f x) = f (p \<bullet> x))"
   shows "p \<bullet> f = f" by perm_simp rule
 
 lemma eqvt_at_apply:
   assumes "eqvt_at f x"
   shows "(p \<bullet> f) x = f x"
-by (metis (hide_lams, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
+by (metis (opaque_lifting, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
 
 lemma eqvt_at_apply':
   assumes "eqvt_at f x"
   shows "p \<bullet> f x = f (p \<bullet> x)"
-by (metis (hide_lams, no_types) assms eqvt_at_def)
+by (metis (opaque_lifting, no_types) assms eqvt_at_def)
 
 lemma eqvt_at_apply'':
   assumes "eqvt_at f x"
   shows "(p \<bullet> f) (p \<bullet> x) = f (p \<bullet> x)"
-by (metis (hide_lams, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
+by (metis (opaque_lifting, no_types) assms eqvt_at_def permute_fun_def permute_minus_cancel(1))
 
 lemma size_list_eqvt[eqvt]: "p \<bullet> size_list f x = size_list (p \<bullet> f) (p \<bullet> x)"
 proof (induction x)
   case (Cons x xs)
   have "f x = p \<bullet> (f x)" by (simp add: permute_pure)
   also have "... = (p \<bullet> f) (p \<bullet> x)" by simp
   with Cons
   show ?case by (auto simp add: permute_pure)
 qed simp
 
 section \<open> Freshness via equivariance \<close>
 
 lemma eqvt_fresh_cong1: "(\<And>p x. p \<bullet> (f x) = f (p \<bullet> x)) \<Longrightarrow> a \<sharp> x \<Longrightarrow> a \<sharp> f x "
   apply (rule fresh_fun_eqvt_app[of f])
   apply (rule eqvtI)
   apply (rule eq_reflection)
   apply (rule ext)
   apply (metis permute_fun_def permute_minus_cancel(1))
   apply assumption
   done
 
 lemma eqvt_fresh_cong2:
   assumes eqvt: "(\<And>p x y. p \<bullet> (f x y) = f (p \<bullet> x) (p \<bullet> y))"
   and fresh1: "a \<sharp> x" and fresh2: "a \<sharp> y"
   shows "a \<sharp> f x y"
 proof-
   have "eqvt (\<lambda> (x,y). f x y)"
     using eqvt
     apply (- , auto simp add: eqvt_def)
     by (rule ext, auto, metis permute_minus_cancel(1))
   moreover
   have "a \<sharp> (x, y)" using fresh1 fresh2 by auto
   ultimately
   have "a \<sharp> (\<lambda> (x,y). f x y) (x, y)" by (rule fresh_fun_eqvt_app)
   thus ?thesis by simp
 qed
 
 lemma eqvt_fresh_star_cong1:
   assumes eqvt: "(\<And>p x. p \<bullet> (f x) = f (p \<bullet> x))"
   and fresh1: "a \<sharp>* x"
   shows "a \<sharp>* f x"
   by (metis fresh_star_def eqvt_fresh_cong1 assms)
 
 lemma eqvt_fresh_star_cong2:
   assumes eqvt: "(\<And>p x y. p \<bullet> (f x y) = f (p \<bullet> x) (p \<bullet> y))"
   and fresh1: "a \<sharp>* x" and fresh2: "a \<sharp>* y"
   shows "a \<sharp>* f x y"
   by (metis fresh_star_def eqvt_fresh_cong2 assms)
 
 lemma eqvt_fresh_cong3:
   assumes eqvt: "(\<And>p x y z. p \<bullet> (f x y z) = f (p \<bullet> x) (p \<bullet> y) (p \<bullet> z))"
   and fresh1: "a \<sharp> x" and fresh2: "a \<sharp> y" and fresh3: "a \<sharp> z"
   shows "a \<sharp> f x y z"
 proof-
   have "eqvt (\<lambda> (x,y,z). f x y z)"
     using eqvt
     apply (- , auto simp add: eqvt_def)
     by(rule ext, auto, metis permute_minus_cancel(1))
   moreover
   have "a \<sharp> (x, y, z)" using fresh1 fresh2 fresh3 by auto
   ultimately
   have "a \<sharp> (\<lambda> (x,y,z). f x y z) (x, y, z)" by (rule fresh_fun_eqvt_app)
   thus ?thesis by simp
 qed
 
 lemma eqvt_fresh_star_cong3:
   assumes eqvt: "(\<And>p x y z. p \<bullet> (f x y z) = f (p \<bullet> x) (p \<bullet> y) (p \<bullet> z))"
   and fresh1: "a \<sharp>* x" and fresh2: "a \<sharp>* y" and fresh3: "a \<sharp>* z"
   shows "a \<sharp>* f x y z"
   by (metis fresh_star_def eqvt_fresh_cong3 assms)
 
 section \<open> Additional simplification rules \<close>
 
 lemma not_self_fresh[simp]: "atom x \<sharp> x \<longleftrightarrow> False"
   by (metis fresh_at_base(2))
 
 lemma fresh_star_singleton: "{ x } \<sharp>* e \<longleftrightarrow> x \<sharp> e"
   by (simp add: fresh_star_def)
 
 section \<open> Additional equivariance lemmas \<close>
 
 lemma eqvt_cases:
   fixes f x \<pi>
   assumes eqvt: "\<And>x. \<pi> \<bullet> f x = f (\<pi> \<bullet> x)"
   obtains "f x" "f (\<pi> \<bullet> x)" | "\<not> f x " " \<not> f (\<pi> \<bullet> x)"
   using assms[symmetric]
    by (cases "f x") auto
 
 lemma range_eqvt: "\<pi> \<bullet> range Y = range (\<pi> \<bullet> Y)"
   unfolding image_eqvt UNIV_eqvt ..
 
 lemma case_option_eqvt[eqvt]:
   "\<pi> \<bullet> case_option d f x = case_option (\<pi> \<bullet> d) (\<pi> \<bullet> f) (\<pi> \<bullet> x)"
   by(cases x)(simp_all)
 
 lemma supp_option_eqvt:
   "supp (case_option d f x) \<subseteq> supp d \<union> supp f \<union> supp x"
   apply (cases x)
   apply (auto simp add: supp_Some )
   apply (metis (mono_tags) Un_iff subsetCE supp_fun_app)
   done
 
 lemma funpow_eqvt[simp,eqvt]:
   "\<pi> \<bullet> ((f :: 'a \<Rightarrow> 'a::pt) ^^ n) = (\<pi> \<bullet> f) ^^ (\<pi> \<bullet> n)"
  by (induct n,simp, rule ext, simp, perm_simp,simp)
 
 lemma delete_eqvt[eqvt]:
   "\<pi> \<bullet> AList.delete x \<Gamma> = AList.delete (\<pi> \<bullet> x) (\<pi> \<bullet> \<Gamma>)"
 by (induct \<Gamma>, auto)
 
 lemma restrict_eqvt[eqvt]:
   "\<pi> \<bullet> AList.restrict S \<Gamma> = AList.restrict (\<pi> \<bullet> S) (\<pi> \<bullet> \<Gamma>)"
 unfolding AList.restrict_eq by perm_simp rule
 
 lemma supp_restrict:
   "supp (AList.restrict S \<Gamma>) \<subseteq> supp \<Gamma>"
  by (induction \<Gamma>) (auto simp add: supp_Pair supp_Cons)
 
 lemma clearjunk_eqvt[eqvt]:
   "\<pi> \<bullet> AList.clearjunk \<Gamma> = AList.clearjunk (\<pi> \<bullet> \<Gamma>)"
   by (induction \<Gamma> rule: clearjunk.induct) auto
 
 lemma map_ran_eqvt[eqvt]:
   "\<pi> \<bullet> map_ran f \<Gamma> = map_ran (\<pi> \<bullet> f) (\<pi> \<bullet> \<Gamma>)"
 by (induct \<Gamma>, auto)
 
 lemma dom_perm:
   "dom (\<pi> \<bullet> f) = \<pi> \<bullet> (dom f)"
   unfolding dom_def by (perm_simp) (simp)
 
 lemmas dom_perm_rev[simp,eqvt] = dom_perm[symmetric]
 
 lemma ran_perm[simp]:
   "\<pi> \<bullet> (ran f) = ran (\<pi> \<bullet> f)"
   unfolding ran_def by (perm_simp) (simp)
 
 lemma map_add_eqvt[eqvt]:
   "\<pi> \<bullet> (m1 ++ m2) = (\<pi> \<bullet> m1) ++ (\<pi> \<bullet> m2)"
   unfolding map_add_def
   by (perm_simp, rule)
 
 lemma map_of_eqvt[eqvt]:
   "\<pi> \<bullet> map_of l = map_of (\<pi> \<bullet> l)"
   by (induct l, simp add: permute_fun_def,simp,perm_simp,auto)
 
 lemma concat_eqvt[eqvt]: "\<pi> \<bullet> concat l = concat (\<pi> \<bullet> l)"
   by (induction l)(auto simp add: append_eqvt)
 
 lemma tranclp_eqvt[eqvt]: "\<pi> \<bullet> tranclp P v\<^sub>1 v\<^sub>2 = tranclp (\<pi> \<bullet> P) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)" 
   unfolding tranclp_def by perm_simp rule
 
 lemma rtranclp_eqvt[eqvt]: "\<pi> \<bullet> rtranclp P v\<^sub>1 v\<^sub>2 = rtranclp (\<pi> \<bullet> P) (\<pi> \<bullet> v\<^sub>1) (\<pi> \<bullet> v\<^sub>2)" 
   unfolding rtranclp_def by perm_simp rule
 
 lemma Set_filter_eqvt[eqvt]: "\<pi> \<bullet> Set.filter P S = Set.filter (\<pi> \<bullet> P) (\<pi> \<bullet> S)"
   unfolding Set.filter_def
   by perm_simp rule
 
 lemma Sigma_eqvt'[eqvt]: "\<pi> \<bullet> Sigma = Sigma"
   apply (rule ext)
   apply (rule ext)
   apply (subst permute_fun_def)
   apply (subst permute_fun_def)
   unfolding Sigma_def
   apply perm_simp
   apply (simp add: permute_self)
   done
 
 lemma override_on_eqvt[eqvt]:
   "\<pi> \<bullet> (override_on m1 m2 S) = override_on (\<pi> \<bullet> m1) (\<pi> \<bullet> m2) (\<pi> \<bullet> S)"
   by (auto simp add: override_on_def )
 
 lemma card_eqvt[eqvt]:
   "\<pi> \<bullet> (card S) = card (\<pi> \<bullet> S)"
 by (cases "finite S", induct rule: finite_induct) (auto simp add: card_insert_if mem_permute_iff permute_pure)
 
 (* Helper lemmas provided by Christian Urban *)
 
 lemma Projl_permute:
   assumes a: "\<exists>y. f = Inl y"
   shows "(p \<bullet> (Sum_Type.projl f)) = Sum_Type.projl (p \<bullet> f)"
 using a by auto
 
 lemma Projr_permute:
   assumes a: "\<exists>y. f = Inr y"
   shows "(p \<bullet> (Sum_Type.projr f)) = Sum_Type.projr (p \<bullet> f)"
 using a by auto
 
 section \<open> Freshness lemmas \<close>
 
 lemma fresh_list_elem:
   assumes "a \<sharp> \<Gamma>"
   and "e \<in> set \<Gamma>"
   shows "a \<sharp> e"
 using assms
 by(induct \<Gamma>)(auto simp add: fresh_Cons)
 
 lemma set_not_fresh:
   "x \<in> set L \<Longrightarrow> \<not>(atom x \<sharp> L)"
   by (metis fresh_list_elem not_self_fresh)
 
 lemma pure_fresh_star[simp]: "a \<sharp>* (x :: 'a :: pure)"
   by (simp add: fresh_star_def pure_fresh)
 
 lemma supp_set_mem: "x \<in> set L \<Longrightarrow> supp x \<subseteq> supp L"
   by (induct L) (auto simp add: supp_Cons)
 
 lemma set_supp_mono: "set L \<subseteq> set L2 \<Longrightarrow> supp L \<subseteq> supp L2"
   by (induct L)(auto simp add: supp_Cons supp_Nil dest:supp_set_mem)
 
 lemma fresh_star_at_base:
   fixes x :: "'a :: at_base"
   shows "S \<sharp>* x \<longleftrightarrow> atom x \<notin> S"
   by (metis fresh_at_base(2) fresh_star_def)
 
 section \<open> Freshness and support for subsets of variables \<close>
 
 lemma supp_mono: "finite (B::'a::fs set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> supp A \<subseteq> supp B"
   by (metis infinite_super subset_Un_eq supp_of_finite_union)
 
 lemma fresh_subset:
   "finite B \<Longrightarrow> x \<sharp> (B :: 'a::at_base set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> x \<sharp> A"
   by (auto dest:supp_mono simp add: fresh_def)
 
 lemma fresh_star_subset:
   "finite B \<Longrightarrow> x \<sharp>* (B :: 'a::at_base set) \<Longrightarrow> A \<subseteq> B \<Longrightarrow> x \<sharp>* A"
   by (metis fresh_star_def fresh_subset)
 
 lemma fresh_star_set_subset:
   "x \<sharp>* (B :: 'a::at_base list) \<Longrightarrow> set A \<subseteq> set B \<Longrightarrow> x \<sharp>* A"
   by (metis fresh_star_set fresh_star_subset[OF finite_set])
 
 section \<open> The set of free variables of an expression \<close>
 
 definition fv :: "'a::pt \<Rightarrow> 'b::at_base set"
   where "fv e = {v. atom v \<in> supp e}"
 
 lemma fv_eqvt[simp,eqvt]: "\<pi> \<bullet> (fv e) = fv (\<pi> \<bullet> e)"
   unfolding fv_def by simp
 
 lemma fv_Nil[simp]: "fv [] = {}"
   by (auto simp add: fv_def supp_Nil)
 lemma fv_Cons[simp]: "fv (x # xs) = fv x \<union> fv xs"
   by (auto simp add: fv_def supp_Cons)
 lemma fv_Pair[simp]: "fv (x, y) = fv x \<union> fv y"
   by (auto simp add: fv_def supp_Pair)
 lemma fv_append[simp]: "fv (x @ y) = fv x \<union> fv y"
   by (auto simp add: fv_def supp_append)
 lemma fv_at_base[simp]: "fv a = {a::'a::at_base}"
   by (auto simp add: fv_def supp_at_base)
 lemma fv_pure[simp]: "fv (a::'a::pure) = {}"
   by (auto simp add: fv_def pure_supp)
 
 lemma fv_set_at_base[simp]: "fv (l :: ('a :: at_base) list) = set l"
   by (induction l) auto
 
 lemma flip_not_fv: "a \<notin> fv x \<Longrightarrow> b \<notin> fv x \<Longrightarrow> (a \<leftrightarrow> b) \<bullet> x = x"
   by (metis flip_def fresh_def fv_def mem_Collect_eq swap_fresh_fresh)
 
 lemma fv_not_fresh: "atom x \<sharp> e \<longleftrightarrow> x \<notin> fv e"
   unfolding fv_def fresh_def by blast
 
 lemma fresh_fv: "finite (fv e :: 'a set) \<Longrightarrow>  atom (x :: ('a::at_base)) \<sharp> (fv e :: 'a set) \<longleftrightarrow> atom x \<sharp> e"
   unfolding fv_def fresh_def
   by (auto simp add: supp_finite_set_at_base)
 
 lemma finite_fv[simp]: "finite (fv (e::'a::fs) :: ('b::at_base) set)"
 proof-
   have "finite (supp e)" by (metis finite_supp)
   hence "finite (atom -` supp e :: 'b set)" 
     apply (rule finite_vimageI)
     apply (rule inj_onI)
     apply (simp)
     done
   moreover
   have "(atom -` supp e  :: 'b set) = fv e"   unfolding fv_def by auto
   ultimately
   show ?thesis by simp
 qed
 
 definition fv_list :: "'a::fs \<Rightarrow> 'b::at_base list"
   where "fv_list e = (SOME l. set l = fv e)"
 
 lemma set_fv_list[simp]: "set (fv_list e) = (fv e :: ('b::at_base) set)"
 proof-
   have "finite (fv e :: 'b set)" by (rule finite_fv)
   from finite_list[OF finite_fv]
   obtain l where "set l = (fv e :: 'b set)"..
   thus ?thesis
     unfolding fv_list_def by (rule someI)
 qed
 
 lemma fresh_fv_list[simp]:
   "a \<sharp> (fv_list e :: 'b::at_base list) \<longleftrightarrow> a \<sharp> (fv e :: 'b::at_base set)"
 proof-
   have "a \<sharp> (fv_list e :: 'b::at_base list) \<longleftrightarrow> a \<sharp> set (fv_list e :: 'b::at_base list)"
     by (rule fresh_set[symmetric])
   also have "\<dots> \<longleftrightarrow> a \<sharp> (fv e :: 'b::at_base set)" by simp
   finally show ?thesis.
 qed
 
 section \<open> Other useful lemmas \<close>
 
 lemma pure_permute_id: "permute p = (\<lambda> x. (x::'a::pure))"
   by rule (simp add: permute_pure)
 
 lemma supp_set_elem_finite:
   assumes "finite S"
   and "(m::'a::fs) \<in> S"
   and "y \<in> supp m"
   shows "y \<in> supp S"
   using assms supp_of_finite_sets
   by auto
 
 lemmas fresh_star_Cons = fresh_star_list(2)
 
 lemma mem_permute_set: 
   shows "x \<in> p \<bullet> S \<longleftrightarrow> (- p \<bullet> x) \<in> S"
   by (metis mem_permute_iff permute_minus_cancel(2))
 
 lemma flip_set_both_not_in:
   assumes "x \<notin> S" and "x' \<notin> S"
   shows "((x' \<leftrightarrow> x) \<bullet> S) = S"
   unfolding permute_set_def
   by (auto) (metis assms flip_at_base_simps(3))+
 
 lemma inj_atom: "inj atom" by (metis atom_eq_iff injI)
 
 lemmas image_Int[OF inj_atom, simp]
 
 lemma eqvt_uncurry: "eqvt f \<Longrightarrow> eqvt (case_prod f)"
   unfolding eqvt_def
   by perm_simp simp
 
 lemma supp_fun_app_eqvt2:
   assumes a: "eqvt f"
   shows "supp (f x y) \<subseteq> supp x \<union> supp y"
 proof-
   from supp_fun_app_eqvt[OF eqvt_uncurry [OF a]]
   have "supp (case_prod f (x,y)) \<subseteq> supp (x,y)".
   thus ?thesis by (simp add: supp_Pair)
 qed
 
 lemma supp_fun_app_eqvt3:
   assumes a: "eqvt f"
   shows "supp (f x y z) \<subseteq> supp x \<union> supp y \<union> supp z"
 proof-
   from supp_fun_app_eqvt2[OF eqvt_uncurry [OF a]]
   have "supp (case_prod f (x,y) z) \<subseteq> supp (x,y) \<union> supp z".
   thus ?thesis by (simp add: supp_Pair)
 qed
 
 (* Fighting eta-contraction *)
 lemma permute_0[simp]: "permute 0 = (\<lambda> x. x)"
   by auto
 lemma permute_comp[simp]: "permute x \<circ> permute y = permute (x + y)" by auto
 
 lemma map_permute: "map (permute p) = permute p"
   apply rule
   apply (induct_tac x)
   apply auto
   done
 
 lemma fresh_star_restrictA[intro]: "a \<sharp>* \<Gamma> \<Longrightarrow> a \<sharp>* AList.restrict V \<Gamma>"
   by (induction \<Gamma>) (auto simp add: fresh_star_Cons)
 
 lemma Abs_lst_Nil_eq[simp]: "[[]]lst. (x::'a::fs) = [xs]lst. x' \<longleftrightarrow> (([],x) = (xs, x'))"
   apply rule
   apply (frule Abs_lst_fcb2[where f = "\<lambda> x y _ . (x,y)" and as = "[]" and bs = "xs" and c = "()"])
   apply (auto simp add: fresh_star_def)
   done
 
 lemma Abs_lst_Nil_eq2[simp]: "[xs]lst. (x::'a::fs) = [[]]lst. x' \<longleftrightarrow> ((xs,x) = ([], x'))"
   by (subst eq_commute) auto
 
 lemma prod_cases8 [cases type]:
   obtains (fields) a b c d e f g h where "y = (a, b, c, d, e, f, g,h)"
   by (cases y, case_tac g) blast
 
 lemma prod_induct8 [case_names fields, induct type]:
   "(\<And>a b c d e f g h. P (a, b, c, d, e, f, g, h)) \<Longrightarrow> P x"
   by (cases x) blast
 
 lemma prod_cases9 [cases type]:
   obtains (fields) a b c d e f g h i where "y = (a, b, c, d, e, f, g,h,i)"
   by (cases y, case_tac h) blast
 
 lemma prod_induct9 [case_names fields, induct type]:
   "(\<And>a b c d e f g h i. P (a, b, c, d, e, f, g, h, i)) \<Longrightarrow> P x"
   by (cases x) blast
 
 named_theorems nominal_prod_simps 
 
 named_theorems ms_fresh "Facts for helping with freshness proofs"
 
 lemma fresh_prod2[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b) = (x \<sharp> a \<and> x \<sharp> b )"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod3[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod4[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod5[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod6[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod7[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod8[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h )"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod9[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod10[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i,j) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i \<and> x \<sharp> j)"
   using fresh_def supp_Pair by fastforce
 
 lemma fresh_prod12[nominal_prod_simps,ms_fresh]: "x \<sharp> (a,b,c,d,e,f,g,h,i,j,k,l) = (x \<sharp> a \<and> x \<sharp> b  \<and> x \<sharp> c  \<and> x \<sharp> d \<and> x \<sharp> e \<and> x \<sharp> f \<and> x \<sharp> g \<and> x \<sharp> h \<and> x \<sharp> i \<and> x \<sharp> j \<and> x \<sharp> k \<and> x \<sharp> l)"
   using fresh_def supp_Pair by fastforce
 
 lemmas fresh_prodN = fresh_Pair fresh_prod3  fresh_prod4  fresh_prod5 fresh_prod6 fresh_prod7 fresh_prod8 fresh_prod9 fresh_prod10 fresh_prod12
 
 lemma fresh_prod2I:
   fixes x and x1 and x2
   assumes "x \<sharp> x1" and "x \<sharp> x2" 
   shows "x \<sharp> (x1,x2)" using fresh_prod2 assms by auto
 
 lemma fresh_prod3I:
   fixes x and x1 and x2 and x3 
   assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" 
   shows "x \<sharp> (x1,x2,x3)" using fresh_prod3 assms by auto
 
 lemma fresh_prod4I:
   fixes x and x1 and x2 and x3 and x4
   assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" and "x \<sharp> x4" 
   shows "x \<sharp> (x1,x2,x3,x4)" using fresh_prod4 assms by auto
 
 lemma fresh_prod5I:
   fixes x and x1 and x2 and x3 and x4 and x5
   assumes "x \<sharp> x1" and "x \<sharp> x2" and "x \<sharp> x3" and "x \<sharp> x4" and "x \<sharp> x5"
   shows "x \<sharp> (x1,x2,x3,x4,x5)" using fresh_prod5 assms by auto
 
 lemma flip_collapse[simp]:
   fixes b1::"'a::pt" and bv1::"'b::at" and bv2::"'b::at"
   assumes "atom bv2 \<sharp> b1" and "atom c \<sharp> (bv1,bv2,b1)" and "bv1 \<noteq> bv2" 
   shows "(bv2 \<leftrightarrow> c) \<bullet> (bv1 \<leftrightarrow> bv2) \<bullet> b1 = (bv1 \<leftrightarrow> c) \<bullet> b1"
 proof - 
   have "c  \<noteq> bv1" and "bv2 \<noteq> bv1" using assms by auto+
   hence "(bv2 \<leftrightarrow> c) + (bv1 \<leftrightarrow> bv2) + (bv2 \<leftrightarrow> c) =  (bv1 \<leftrightarrow> c)" using flip_triple[of c bv1 bv2] flip_commute by metis
   hence "(bv2 \<leftrightarrow> c)  \<bullet> (bv1 \<leftrightarrow> bv2)  \<bullet> (bv2 \<leftrightarrow> c) \<bullet> b1 =  (bv1 \<leftrightarrow> c) \<bullet> b1" using permute_plus by metis
   thus ?thesis using assms flip_fresh_fresh by force
 qed
 
 lemma triple_eqvt[simp]:
   "p \<bullet> (x, b,c) = (p \<bullet> x,  p \<bullet> b , p \<bullet> c)"
 proof - 
   have "(x,b,c) = (x,(b,c))" by simp
   thus ?thesis using Pair_eqvt by simp
 qed
 
 lemma lst_fst:
   fixes x::"'a::at" and t1::"'b::fs" and  x'::"'a::at" and t2::"'c::fs" 
   assumes " ([[atom x]]lst. (t1,t2) = [[atom x']]lst. (t1',t2'))"
   shows " ([[atom x]]lst. t1 = [[atom x']]lst. t1')"
 proof - 
   have "(\<forall>c. atom c \<sharp> (t2,t2') \<longrightarrow> atom c \<sharp> (x, x', t1, t1') \<longrightarrow> (x \<leftrightarrow> c) \<bullet> t1 = (x' \<leftrightarrow> c) \<bullet> t1')" 
   proof(rule,rule,rule)
     fix c::'a
     assume "atom c \<sharp>  (t2,t2')" and "atom c \<sharp> (x, x', t1, t1')" 
     hence "atom c \<sharp> (x, x', (t1,t2), (t1',t2'))"  using fresh_prod2 by simp
     thus  " (x \<leftrightarrow> c) \<bullet> t1 = (x' \<leftrightarrow> c) \<bullet> t1'" using assms Abs1_eq_iff_all(3) Pair_eqvt by simp
   qed
   thus ?thesis using Abs1_eq_iff_all(3)[of x t1 x' t1' "(t2,t2')"] by simp
 qed
 
 lemma lst_snd:
   fixes x::"'a::at" and t1::"'b::fs" and  x'::"'a::at" and t2::"'c::fs" 
   assumes " ([[atom x]]lst. (t1,t2) = [[atom x']]lst. (t1',t2'))"
   shows " ([[atom x]]lst. t2 = [[atom x']]lst. t2')"
 proof - 
   have "(\<forall>c. atom c \<sharp> (t1,t1') \<longrightarrow> atom c \<sharp> (x, x', t2, t2') \<longrightarrow> (x \<leftrightarrow> c) \<bullet> t2 = (x' \<leftrightarrow> c) \<bullet> t2')" 
   proof(rule,rule,rule)
     fix c::'a
     assume "atom c \<sharp>  (t1,t1')" and "atom c \<sharp> (x, x', t2, t2')" 
     hence "atom c \<sharp> (x, x', (t1,t2), (t1',t2'))"  using fresh_prod2 by simp
     thus  " (x \<leftrightarrow> c) \<bullet> t2 = (x' \<leftrightarrow> c) \<bullet> t2'" using assms Abs1_eq_iff_all(3) Pair_eqvt by simp
   qed
   thus ?thesis using Abs1_eq_iff_all(3)[of x t2 x' t2' "(t1,t1')"] by simp
 qed
 
 lemma lst_head_cons_pair:
   fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
   assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (x2 # xs2)"
   shows "[[atom y1]]lst. (x1,xs1) = [[atom y2]]lst. (x2,xs2)"
 proof(subst  Abs1_eq_iff_all(3)[of y1 "(x1,xs1)"  y2 "(x2,xs2)"],rule,rule,rule)
   fix c::'a
   assume "atom c \<sharp> (x1#xs1,x2#xs2)" and "atom c \<sharp> (y1, y2, (x1, xs1), x2, xs2)" 
   thus  "(y1 \<leftrightarrow> c) \<bullet> (x1, xs1) = (y2 \<leftrightarrow> c) \<bullet> (x2, xs2)"  using assms Abs1_eq_iff_all(3) by auto
 qed
 
 lemma lst_head_cons_neq_nil:
   fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
   assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (xs2)"
   shows "xs2 \<noteq> []"
 proof
   assume as:"xs2 = []"
   thus  False using Abs1_eq_iff(3)[of y1 "x1#xs1" y2 Nil]  assms as by auto
 qed
 
 lemma lst_head_cons:
   fixes y1::"'a ::at" and y2::"'a::at" and x1::"'b::fs" and x2::"'b::fs" and xs1::"('b::fs) list" and xs2::"('b::fs) list"
   assumes "[[atom y1]]lst. (x1 # xs1) = [[atom y2]]lst. (x2 # xs2)"
   shows "[[atom y1]]lst. x1  = [[atom y2]]lst. x2" and "[[atom y1]]lst. xs1  = [[atom y2]]lst. xs2"
   using lst_head_cons_pair lst_fst lst_snd assms by metis+
 
 lemma lst_pure:
   fixes x1::"'a ::at" and t1::"'b::pure" and  x2::"'a ::at" and t2::"'b::pure" 
   assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"
   shows "t1=t2"
   using assms Abs1_eq_iff_all(3) pure_fresh flip_fresh_fresh 
   by (metis Abs1_eq(3) permute_pure)
 
 lemma lst_supp:
  assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"
  shows "supp t1 - {atom x1} = supp t2 - {atom x2}"
 proof -
  have "supp ([[atom x1]]lst.t1) = supp ([[atom x2]]lst.t2)" using assms by auto
  thus ?thesis using Abs_finite_supp  
    by (metis assms empty_set list.simps(15) supp_lst.simps)
 qed
 
 lemma lst_supp_subset:
    assumes "[[atom x1]]lst. t1 = [[atom x2]]lst. t2" and "supp t1 \<subseteq> {atom x1} \<union> B"
    shows "supp t2 \<subseteq> {atom x2} \<union> B"
   using assms lst_supp by fast
 
 lemma projl_inl_eqvt:
   fixes \<pi> :: perm
   shows   "\<pi> \<bullet> (projl (Inl x)) = projl (Inl (\<pi> \<bullet> x))"
 unfolding projl_def Inl_eqvt by simp
 
 end
diff --git a/thys/MiniSail/Safety.thy b/thys/MiniSail/Safety.thy
--- a/thys/MiniSail/Safety.thy
+++ b/thys/MiniSail/Safety.thy
@@ -1,1812 +1,1812 @@
 (*<*)
 theory Safety
   imports Operational IVSubstTypingL BTVSubstTypingL 
 begin
   (*>*)
 
-method supp_calc = (metis (mono_tags, hide_lams) pure_supp  c.supp e.supp v.supp supp_l_empty opp.supp sup_bot.right_neutral supp_at_base)
+method supp_calc = (metis (mono_tags, opaque_lifting) pure_supp  c.supp e.supp v.supp supp_l_empty opp.supp sup_bot.right_neutral supp_at_base)
 declare infer_e.intros[simp]
 declare infer_e.intros[intro]
 
 chapter \<open>Safety\<close>
 
 text \<open>Lemmas about the operational semantics leading up to progress and preservation and then
 safety.\<close>
 
 section \<open>Store Lemmas\<close>
 
 abbreviation delta_ext (" _ \<sqsubseteq> _ ") where  
   "delta_ext \<Delta> \<Delta>' \<equiv> (setD \<Delta> \<subseteq> setD \<Delta>')" 
 
 nominal_function dc_of :: "branch_s \<Rightarrow> string" where
   "dc_of (AS_branch dc _ _) = dc"
   apply(auto,simp add: eqvt_def dc_of_graph_aux_def)
   using   s_branch_s_branch_list.exhaust by metis
 nominal_termination (eqvt) by lexicographic_order
 
 lemma delta_sim_fresh: 
   assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and "atom u \<sharp> \<delta>"
   shows "atom u \<sharp> \<Delta>"
   using assms proof(induct rule : delta_sim.inducts)
   case (delta_sim_nilI \<Theta>)
   then show ?case using fresh_def supp_DNil by blast
 next
   case (delta_sim_consI \<Theta> \<delta> \<Delta> v \<tau> u')
   hence  "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using check_v_wf  by meson
   hence  "supp \<tau> = {}" using  wfT_supp by fastforce
   moreover have  "atom u \<sharp> u'" using delta_sim_consI fresh_Cons fresh_Pair by blast
   moreover have "atom u \<sharp> \<Delta>" using delta_sim_consI fresh_Cons by blast
   ultimately show ?case using fresh_Pair fresh_DCons fresh_def by blast
 qed
 
 lemma delta_sim_v: 
   fixes \<Delta>::\<Delta>
   assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta> " and "(u,v) \<in> set \<delta>" and "(u,\<tau>) \<in> setD \<Delta>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"
   shows "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>"
   using assms proof(induct \<delta> arbitrary: \<Delta>)
   case Nil
   then show ?case by auto
 next
   case (Cons uv \<delta>)
   obtain u' and v' where uv : "uv=(u',v')" by fastforce
   show ?case proof(cases "u'=u")
     case True
     hence  *:"\<Theta> \<turnstile> ((u,v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
     then obtain \<tau>' and \<Delta>' where tt: "\<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u \<notin> fst ` set \<delta> \<and> \<Delta> = (u,\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims(3)[OF *] by metis
     moreover hence "v'=v" using Cons True 
       by (metis Pair_inject fst_conv image_eqI set_ConsD uv)
     moreover have "\<tau>=\<tau>'" using wfD_unique tt Cons 
         setD.simps list.set_intros by blast
     ultimately show ?thesis by metis
   next
     case False
     hence  *:"\<Theta> \<turnstile> ((u',v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
     then obtain \<tau>' and \<Delta>' where tt: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>' \<and> \<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u' \<notin> fst ` set \<delta> \<and> \<Delta> = (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims(3)[OF *] by metis
 
     moreover hence "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wfD_elims Cons delta_sim_elims by metis
     ultimately show ?thesis using Cons  
       using False by auto
   qed
 qed
 
 lemma delta_sim_delta_lookup:
   assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta> " and "(u, \<lbrace> z : b  | c \<rbrace>) \<in> setD \<Delta>" 
   shows "\<exists>v. (u,v) \<in> set \<delta>"
   using assms by(induct rule: delta_sim.inducts,auto+)
 
 lemma update_d_stable:
   "fst ` set \<delta> = fst ` set (update_d \<delta> u v)"
 proof(induct \<delta>)
   case Nil
   then show ?case by auto
 next
   case (Cons a \<delta>)
   then show ?case using update_d.simps
     by (metis (no_types, lifting) eq_fst_iff image_cong image_insert list.simps(15) prod.exhaust_sel)
 qed
 
 lemma update_d_sim:
   fixes \<Delta>::\<Delta>
   assumes "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>" and "(u,\<tau>) \<in> setD \<Delta>" and "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>"
   shows "\<Theta> \<turnstile> (update_d \<delta> u v) \<sim> \<Delta>"
   using assms proof(induct \<delta> arbitrary: \<Delta>)
   case Nil
   then show ?case using delta_sim_consI by simp
 next
   case (Cons uv \<delta>)
   obtain u' and v' where uv : "uv=(u',v')" by fastforce
 
   hence  *:"\<Theta> \<turnstile> ((u',v')#\<delta>) \<sim> \<Delta>" using uv Cons by blast
   then obtain \<tau>' and \<Delta>' where tt: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>' \<and> \<Theta> ; {||} ; GNil \<turnstile> v' \<Leftarrow> \<tau>' \<and> u' \<notin> fst ` set \<delta> \<and> \<Delta> = (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" using delta_sim_elims * by metis
 
   show ?case proof(cases "u=u'")
     case True
     then have "(u,\<tau>') \<in> setD \<Delta>" using tt by auto
     then have "\<tau> = \<tau>'" using Cons  wfD_unique by metis
     moreover  have "update_d ((u',v')#\<delta>) u v = ((u',v)#\<delta>)" using update_d.simps True by presburger
     ultimately show ?thesis using delta_sim_consI tt Cons True 
       by (simp add: tt uv)
   next
     case False
     have  "\<Theta> \<turnstile> (u',v') # (update_d \<delta> u v) \<sim> (u',\<tau>')#\<^sub>\<Delta>\<Delta>'" 
     proof(rule delta_sim_consI)
       show "\<Theta> \<turnstile> update_d \<delta> u v \<sim> \<Delta>' " using Cons using delta_sim_consI 
           delta_sim.simps update_d.simps Cons  delta_sim_elims uv  tt 
           False fst_conv set_ConsD wfG_elims wfD_elims  by (metis setD_ConsD)
       show "\<Theta> ; {||} ; GNil  \<turnstile> v' \<Leftarrow> \<tau>'" using tt by auto
       show "u' \<notin> fst ` set (update_d \<delta> u v)" using  update_d.simps Cons update_d_stable tt by auto
     qed
     thus  ?thesis using False update_d.simps uv 
       by (simp add: tt)
   qed
 qed
 
 section \<open>Preservation\<close>
 text \<open>Types are preserved under reduction step. Broken down into lemmas about different operations\<close>
 
 subsection \<open>Function Application\<close>
 
 lemma check_s_x_fresh:
   fixes x::x and s::s
   assumes "\<Theta> ; \<Phi> ; B ;  GNil ; D  \<turnstile> s \<Leftarrow> \<tau>" 
   shows "atom x \<sharp> s \<and> atom x \<sharp> \<tau> \<and> atom x \<sharp> D"
 proof - 
   have "\<Theta> ; \<Phi> ; B ; GNil ; D \<turnstile>\<^sub>w\<^sub>f s : b_of \<tau>"  using check_s_wf[OF assms] by auto 
   moreover have "\<Theta> ; B ; GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> " using check_s_wf assms by auto
   moreover have "\<Theta> ; B ; GNil   \<turnstile>\<^sub>w\<^sub>f D" using check_s_wf assms by auto
   ultimately show ?thesis using wf_supp x_fresh_u 
     by (meson fresh_GNil wfS_x_fresh wfT_x_fresh wfD_x_fresh)
 qed
 
 lemma check_funtyp_subst_b: 
   fixes b'::b
   assumes "check_funtyp \<Theta> \<Phi> {|bv|} (AF_fun_typ x b c \<tau> s)" and \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close>
   shows "check_funtyp \<Theta> \<Phi>  {||} (AF_fun_typ x b[bv::=b']\<^sub>b\<^sub>b (c[bv::=b']\<^sub>c\<^sub>b) \<tau>[bv::=b']\<^sub>\<tau>\<^sub>b s[bv::=b']\<^sub>s\<^sub>b)"
   using assms proof (nominal_induct "{|bv|}" "AF_fun_typ x b c \<tau> s" rule: check_funtyp.strong_induct)
   case (check_funtypI x' \<Theta> \<Phi> c' s' \<tau>')
   have "check_funtyp \<Theta> \<Phi> {||} (AF_fun_typ x' b[bv::=b']\<^sub>b\<^sub>b (c'[bv::=b']\<^sub>c\<^sub>b) \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b s'[bv::=b']\<^sub>s\<^sub>b)" proof
     show \<open>atom x' \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, b[bv::=b']\<^sub>b\<^sub>b)\<close> using check_funtypI fresh_prodN x_fresh_b fresh_empty_fset by metis
 
     have  \<open> \<Theta> ; \<Phi> ; {||} ; ((x', b, c') #\<^sub>\<Gamma> GNil)[bv::=b']\<^sub>\<Gamma>\<^sub>b ; []\<^sub>\<Delta>[bv::=b']\<^sub>\<Delta>\<^sub>b  \<turnstile> s'[bv::=b']\<^sub>s\<^sub>b \<Leftarrow> \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b\<close>  proof(rule subst_b_check_s)
       show \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close> using check_funtypI by metis
       show \<open>{|bv|} = {|bv|}\<close> by auto
       show \<open> \<Theta> ; \<Phi> ; {|bv|} ; (x', b, c') #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s' \<Leftarrow> \<tau>'\<close> using check_funtypI by metis
     qed
 
     thus \<open> \<Theta> ; \<Phi> ; {||} ; (x', b[bv::=b']\<^sub>b\<^sub>b, c'[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s'[bv::=b']\<^sub>s\<^sub>b \<Leftarrow> \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b\<close> 
       using subst_gb.simps subst_db.simps by simp
   qed
 
   moreover have "(AF_fun_typ x b c \<tau> s) = (AF_fun_typ x' b c' \<tau>' s')"  using fun_typ.eq_iff check_funtypI by metis
   moreover hence "(AF_fun_typ x b[bv::=b']\<^sub>b\<^sub>b (c[bv::=b']\<^sub>c\<^sub>b) \<tau>[bv::=b']\<^sub>\<tau>\<^sub>b s[bv::=b']\<^sub>s\<^sub>b) = (AF_fun_typ x' b[bv::=b']\<^sub>b\<^sub>b (c'[bv::=b']\<^sub>c\<^sub>b) \<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b s'[bv::=b']\<^sub>s\<^sub>b)"
     using  subst_ft_b.simps by metis
   ultimately show  ?case by metis
 qed
 
 lemma funtyp_simple_check:
   fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
   assumes "check_funtyp \<Theta> \<Phi>  ({||}::bv fset) (AF_fun_typ x b c \<tau> s)" and
     "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" 
   shows "\<Theta> ; \<Phi> ;  {||} ; GNil ; DNil \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
   using assms proof(nominal_induct  " ({||}::bv fset)" "AF_fun_typ x b c \<tau> s" avoiding: v x  rule: check_funtyp.strong_induct)
   case (check_funtypI x' \<Theta> \<Phi> c' s' \<tau>')
 
   hence eq1: "\<lbrace> x' : b  | c' \<rbrace> = \<lbrace> x : b  | c \<rbrace>" using funtyp_eq_iff_equalities by metis
 
   obtain x'' and c'' where xf:"\<lbrace> x : b  | c \<rbrace> = \<lbrace> x'' : b | c'' \<rbrace> \<and> atom x'' \<sharp> (x',v) \<and> atom x'' \<sharp> (x,c)" using obtain_fresh_z3 by metis 
   moreover have "atom x' \<sharp> c''" proof -
     have "supp  \<lbrace> x'' : b | c'' \<rbrace> = {}" using eq1 check_funtypI xf check_v_wf wfT_nil_supp by metis 
     hence "supp c'' \<subseteq> { atom x'' }" using  \<tau>.supp eq1 xf by (auto simp add: freshers)
     moreover have "atom x' \<noteq> atom x''" using xf fresh_Pair fresh_x_neq by metis
     ultimately show ?thesis using xf fresh_Pair fresh_x_neq fresh_def fresh_at_base by blast
   qed
   ultimately have eq2: "c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v = c'" using eq1  type_eq_subst_eq3(1)[of x' b c' x'' b  c''] by metis
 
   have "atom x' \<sharp> c" proof -
     have "supp  \<lbrace> x : b | c \<rbrace> = {}" using eq1 check_funtypI xf check_v_wf wfT_nil_supp by metis 
     hence "supp c \<subseteq> { atom x }" using  \<tau>.supp by auto
     moreover have "atom x \<noteq> atom x'" using check_funtypI fresh_Pair fresh_x_neq by metis
     ultimately show ?thesis using fresh_def by force
   qed
   hence eq: " c[x::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v =  c' \<and> s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v" 
     using funtyp_eq_iff_equalities type_eq_subst_eq3 check_funtypI by metis
 
   have " \<Theta> ; \<Phi> ; {||} ; ((x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil)[x'::=v]\<^sub>\<Gamma>\<^sub>v ; []\<^sub>\<Delta>[x'::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v" 
   proof(rule subst_check_check_s )
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x'' : b  | c'' \<rbrace>\<close> using check_funtypI eq1 xf by metis
     show \<open>atom x'' \<sharp> (x', v)\<close> using check_funtypI fresh_x_neq fresh_Pair xf by metis
     show \<open> \<Theta> ; \<Phi> ; {||} ; (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; []\<^sub>\<Delta>  \<turnstile> s' \<Leftarrow> \<tau>'\<close> using check_funtypI eq2 by metis
     show \<open> (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil = GNil  @ (x', b, c''[x''::=[ x' ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil\<close> using append_g.simps by auto
   qed
   hence " \<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v" using subst_gv.simps subst_dv.simps by auto
   thus ?case using eq  by auto
 qed
 
 lemma funtypq_simple_check:
   fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
   assumes "check_funtypq \<Theta> \<Phi>   (AF_fun_typ_none (AF_fun_typ x b c t s))" and
     "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" 
   shows "\<Theta>; \<Phi>; {||}; GNil; DNil \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[x::=v]\<^sub>\<tau>\<^sub>v"
   using assms proof(nominal_induct  "(AF_fun_typ_none (AF_fun_typ x b c t s))" avoiding: v rule: check_funtypq.strong_induct)
   case (check_fundefq_simpleI \<Theta> \<Phi> x' c' t' s')
   hence eq: "\<lbrace> x : b  | c \<rbrace> = \<lbrace> x' : b  | c' \<rbrace> \<and> s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> t[x::=v]\<^sub>\<tau>\<^sub>v = t'[x'::=v]\<^sub>\<tau>\<^sub>v" 
     using funtyp_eq_iff_equalities by metis
   hence "\<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> t'[x'::=v]\<^sub>\<tau>\<^sub>v" 
     using funtyp_simple_check[OF check_fundefq_simpleI(1)] check_fundefq_simpleI by metis
   thus ?case  using eq by metis
 qed
 
 lemma funtyp_poly_eq_iff_equalities:
   assumes "[[atom bv']]lst. AF_fun_typ x' b'' c' t' s' = [[atom bv]]lst. AF_fun_typ x b c t s" 
   shows "\<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace> \<and> 
           s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v = s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<and> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v = t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
 proof - 
   have "subst_ft_b (AF_fun_typ x' b'' c' t' s') bv' b' = subst_ft_b (AF_fun_typ x b c t s) bv b'"
     using subst_b_flip_eq_two subst_b_fun_typ_def assms by metis
   thus ?thesis using fun_typ.eq_iff subst_ft_b.simps funtyp_eq_iff_equalities subst_tb.simps 
     by (metis (full_types) assms fun_poly_arg_unique)
 
 qed
 
 lemma funtypq_poly_check:
   fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  and b'::b
   assumes "check_funtypq \<Theta> \<Phi>   (AF_fun_typ_some bv (AF_fun_typ x b c t s))" and
     "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>"   and
     "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b'" 
   shows "\<Theta>; \<Phi>; {||}; GNil; DNil \<turnstile> s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v"
   using assms proof(nominal_induct  "(AF_fun_typ_some bv (AF_fun_typ x b c t s))" avoiding: v rule: check_funtypq.strong_induct)
   case (check_funtypq_polyI bv' \<Theta> \<Phi>  x' b'' c' t' s')
 
   hence **:"\<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b  | c[bv::=b']\<^sub>c\<^sub>b \<rbrace> \<and> 
           s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v = s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<and> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v = t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
     using funtyp_poly_eq_iff_equalities by metis
 
   have *:"check_funtyp \<Theta> \<Phi> {||} (AF_fun_typ x' b''[bv'::=b']\<^sub>b\<^sub>b (c'[bv'::=b']\<^sub>c\<^sub>b) (t'[bv'::=b']\<^sub>\<tau>\<^sub>b) s'[bv'::=b']\<^sub>s\<^sub>b)"
     using check_funtyp_subst_b[OF check_funtypq_polyI(5) check_funtypq_polyI(8)]  by metis
   moreover have "\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x' : b''[bv'::=b']\<^sub>b\<^sub>b  | c'[bv'::=b']\<^sub>c\<^sub>b \<rbrace>" using ** check_funtypq_polyI by metis
   ultimately have "\<Theta>; \<Phi>; {||}; GNil; []\<^sub>\<Delta>  \<turnstile> s'[bv'::=b']\<^sub>s\<^sub>b[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> t'[bv'::=b']\<^sub>\<tau>\<^sub>b[x'::=v]\<^sub>\<tau>\<^sub>v"
     using funtyp_simple_check[OF *] check_funtypq_polyI by metis
   thus ?case using ** by metis
 
 qed
 
 lemma fundef_simple_check:
   fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  
   assumes "check_fundef \<Theta> \<Phi>   (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c t s)))" and
     "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b | c \<rbrace>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[x::=v]\<^sub>\<tau>\<^sub>v"
   using assms proof(nominal_induct  "(AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c t s)))" avoiding: v rule: check_fundef.strong_induct)
   case (check_fundefI \<Theta> \<Phi>)
   then show ?case using funtypq_simple_check[THEN check_s_d_weakening(1) ] setD.simps by auto
 qed
 
 lemma fundef_poly_check:
   fixes s::s  and \<Delta>::\<Delta> and \<tau>::\<tau> and v::v  and b'::b
   assumes "check_fundef \<Theta> \<Phi>   (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c t s)))" and
     "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<lbrace> x : b[bv::=b']\<^sub>b\<^sub>b | c[bv::=b']\<^sub>c\<^sub>b \<rbrace>" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>" and  "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f b'" 
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s[bv::=b']\<^sub>s\<^sub>b[x::=v]\<^sub>s\<^sub>v \<Leftarrow> t[bv::=b']\<^sub>\<tau>\<^sub>b[x::=v]\<^sub>\<tau>\<^sub>v" 
   using assms proof(nominal_induct  "(AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c t s)))" avoiding: v rule: check_fundef.strong_induct)
   case (check_fundefI \<Theta> \<Phi>)
   then show ?case using funtypq_poly_check[THEN check_s_d_weakening(1) ] setD.simps by auto
 qed
 
 lemma preservation_app:
   assumes
     "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and  "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
   shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> ss = LET x = (AE_app f v) IN s \<Longrightarrow>  
            \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v) = (s1'[x1::=v]\<^sub>s\<^sub>v) IN s \<Leftarrow> \<tau>" and
     "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
   using assms proof(nominal_induct \<tau> and \<tau> and \<tau>   avoiding: v rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_letI x2 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s2 b c)
 
   hence eq: "e = (AE_app f v)" by simp
   hence *:"\<Theta> ; \<Phi> ; {||} ;GNil ; \<Delta>  \<turnstile> (AE_app f v) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using check_letI by auto
 
   then obtain x3 b3 c3 \<tau>3 s3 where
     **:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x3 b3 c3 \<tau>3 s3))) = lookup_fun \<Phi> f \<and> 
      \<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3  | c3 \<rbrace> \<and>  atom x3 \<sharp> (\<Theta>, \<Phi>, ({||}::bv fset), GNil, \<Delta>, v, \<lbrace> z : b  | c \<rbrace>) \<and>  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | c \<rbrace>"
     using infer_e_elims(6)[OF *] subst_defs by metis
 
   obtain z3 where z3:"\<lbrace> x3 : b3  | c3 \<rbrace> =  \<lbrace> z3 : b3  | c3[x3::=V_var z3]\<^sub>c\<^sub>v \<rbrace> \<and>  atom z3 \<sharp> (x3, v,c3,x1,c1)" using obtain_fresh_z3 by metis
 
   have seq:"[[atom x3]]lst. s3 = [[atom x1]]lst. s1'" using fun_def_eq check_letI ** option.inject by metis
 
   let ?ft = "AF_fun_typ x3 b3 c3 \<tau>3 s3"
 
 
   have sup: "supp \<tau>3 \<subseteq> { atom x3} \<and> supp s3 \<subseteq> { atom x3}"  using wfPhi_f_supp ** by metis
 
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x2  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v (s3[x3::=v]\<^sub>s\<^sub>v) s2 \<Leftarrow> \<tau>" proof
     show \<open>atom x2 \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v, s3[x3::=v]\<^sub>s\<^sub>v, \<tau>)\<close>
       unfolding fresh_prodN using check_letI fresh_subst_v_if subst_v_\<tau>_def sup
       by (metis all_not_in_conv fresh_def fresh_empty_fset fresh_subst_sv_if fresh_subst_tv_if singleton_iff subset_singleton_iff)
 
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s3[x3::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v\<close> proof(rule fundef_simple_check)
       show \<open>check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_none (AF_fun_typ x3 b3 c3 \<tau>3 s3)))\<close> using ** check_letI lookup_fun_member by metis
       show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3  | c3 \<rbrace>\<close> using ** by auto
       show \<open> \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using ** by auto
     qed
     show \<open> \<Theta> ; \<Phi> ; {||} ; (x2, b_of \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v, c_of \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v x2) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close>  
       using check_letI ** b_of.simps c_of.simps subst_defs  by metis
   qed
 
   moreover have "AS_let2 x2  \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v (s3[x3::=v]\<^sub>s\<^sub>v) s2 = AS_let2 x   (\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v) (s1'[x1::=v]\<^sub>s\<^sub>v) s" proof -
     have *: "[[atom x2]]lst. s2 = [[atom x]]lst. s" using check_letI  s_branch_s_branch_list.eq_iff by auto
     moreover have " \<tau>3[x3::=v]\<^sub>\<tau>\<^sub>v = \<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v" using fun_ret_unique ** check_letI by metis
     moreover have "s3[x3::=v]\<^sub>s\<^sub>v = (s1'[x1::=v]\<^sub>s\<^sub>v)" using subst_v_flip_eq_two subst_v_s_def seq by metis
     ultimately show ?thesis using s_branch_s_branch_list.eq_iff by metis
   qed
 
   ultimately show ?case using check_letI by auto
 qed(auto+)
 
 lemma fresh_subst_v_subst_b:
   fixes x2::x and tm::"'a::{has_subst_v,has_subst_b}" and x::x
   assumes  "supp tm \<subseteq> { atom bv, atom x }" and "atom x2 \<sharp> v" 
   shows  "atom x2 \<sharp> tm[bv::=b]\<^sub>b[x::=v]\<^sub>v"  
   using assms proof(cases "x2=x")
   case True
   then show ?thesis using fresh_subst_v_if assms by blast
 next
   case False
   hence "atom x2 \<sharp> tm" using assms fresh_def fresh_at_base by force
   hence "atom x2 \<sharp> tm[bv::=b]\<^sub>b" using  assms fresh_subst_if x_fresh_b False by force
   then show ?thesis using fresh_subst_v_if assms by auto
 qed
 
 lemma preservation_poly_app:
   assumes
     "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and  "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
   shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> ss = LET x = (AE_appP f b' v) IN s \<Longrightarrow> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b'  \<Longrightarrow> 
                \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v) = (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v) IN s \<Leftarrow> \<tau>" and
     "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
   using assms proof(nominal_induct \<tau> and \<tau> and \<tau>   avoiding: v x1 rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_letI x2 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s2 b c)
 
   hence eq: "e = (AE_appP f b' v)" by simp
   hence *:"\<Theta> ; \<Phi> ; {||} ;GNil ; \<Delta>  \<turnstile> (AE_appP f b' v) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" using check_letI by auto
 
   then obtain x3 b3 c3 \<tau>3 s3 bv3 where
     **:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  Some (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3))) = lookup_fun \<Phi> f \<and> 
      \<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3[bv3::=b']\<^sub>b\<^sub>b   | c3[bv3::=b']\<^sub>c\<^sub>b  \<rbrace> \<and>  atom x3 \<sharp> GNil \<and>  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v = \<lbrace> z : b  | c \<rbrace>
   \<and> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b'"
     using infer_e_elims(21)[OF *] subst_defs  by metis
 
   obtain z3 where z3:"\<lbrace> x3 : b3  | c3 \<rbrace> =  \<lbrace> z3 : b3  | c3[x3::=V_var z3]\<^sub>c\<^sub>v \<rbrace> \<and>  atom z3 \<sharp> (x3, v,c3,x1,c1)" using obtain_fresh_z3 by metis
 
   let ?ft = "(AF_fun_typ x3 (b3[bv3::=b']\<^sub>b\<^sub>b) (c3[bv3::=b']\<^sub>c\<^sub>b) (\<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b) (s3[bv3::=b']\<^sub>s\<^sub>b))"
 
   have *:"check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)))" using ** check_letI lookup_fun_member by metis
 
   hence ftq:"check_funtypq \<Theta> \<Phi> (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3))" using check_fundef_elims by auto
 
   let ?ft = "AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)"
 
   have sup: "supp \<tau>3 \<subseteq> { atom x3, atom bv3} \<and> supp s3 \<subseteq> { atom x3, atom bv3 }"  
     using  wfPhi_f_poly_supp_t wfPhi_f_poly_supp_s ** by metis
 
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x2  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v (s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v) s2 \<Leftarrow> \<tau>" 
   proof
     show \<open>atom x2 \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v, s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v, \<tau>)\<close> 
     proof -
 
       have "atom x2 \<sharp> \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v" 
         using fresh_subst_v_subst_b subst_v_\<tau>_def subst_b_\<tau>_def \<open> atom x2 \<sharp> v\<close> sup by fastforce      
       moreover have "atom x2 \<sharp> s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v" 
         using fresh_subst_v_subst_b subst_v_s_def subst_b_s_def \<open> atom x2 \<sharp> v\<close> sup 
       proof -
         have "\<forall>b. atom x2 = atom x3 \<or> atom x2 \<sharp> s3[bv3::=b]\<^sub>b"
           by (metis (no_types) check_letI.hyps(1) fresh_subst_sv_if(1) fresh_subst_v_subst_b insert_commute subst_v_s_def sup) (* 140 ms *)
         then show ?thesis
           by (metis check_letI.hyps(1) fresh_subst_sb_if fresh_subst_sv_if(1) has_subst_b_class.subst_b_fresh_x x_fresh_b) (* 78 ms *)
       qed
       ultimately show ?thesis using fresh_prodN check_letI by metis
     qed
 
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v\<close> proof( rule fundef_poly_check)
       show \<open>check_fundef \<Theta> \<Phi> (AF_fundef f (AF_fun_typ_some bv3 (AF_fun_typ x3 b3 c3 \<tau>3 s3)))\<close>   
         using **  lookup_fun_member check_letI by metis
       show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> x3 : b3[bv3::=b']\<^sub>b\<^sub>b  | c3[bv3::=b']\<^sub>c\<^sub>b \<rbrace>\<close> using ** by metis
       show \<open> \<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using ** by metis
       show \<open> \<Theta> ;  {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close>  using ** by metis
     qed
     show \<open> \<Theta> ; \<Phi> ; {||} ; (x2, b_of \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v, c_of \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v x2) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close> 
       using check_letI ** b_of.simps c_of.simps subst_defs by metis
   qed
 
   moreover have "AS_let2 x2  \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v (s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v) s2 = AS_let2 x   (\<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v) (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v) s" proof -
     have *: "[[atom x2]]lst. s2 = [[atom x]]lst. s" using check_letI  s_branch_s_branch_list.eq_iff by auto
     moreover have " \<tau>3[bv3::=b']\<^sub>\<tau>\<^sub>b[x3::=v]\<^sub>\<tau>\<^sub>v = \<tau>1'[bv1::=b']\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v" using fun_poly_ret_unique ** check_letI by metis
     moreover have "s3[bv3::=b']\<^sub>s\<^sub>b[x3::=v]\<^sub>s\<^sub>v = (s1'[bv1::=b']\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v)" using subst_v_flip_eq_two subst_v_s_def  fun_poly_body_unique ** check_letI by metis
     ultimately show ?thesis using s_branch_s_branch_list.eq_iff by metis
   qed
 
   ultimately show ?case using check_letI by auto
 qed(auto+)
 
 lemma check_s_plus:
   assumes "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) IN s'  \<Leftarrow> \<tau>" 
   shows   "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (L_num (n1+n2)))) IN s' \<Leftarrow> \<tau>"   
 proof  -
   obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2)) \<Rightarrow> t1"
     using assms check_s_elims by metis
   then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_int  | CE_val (V_var z1)  ==  CE_op Plus  ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)  \<rbrace>"
     using infer_e_plus by metis
 
   obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit (L_num (n1+n2))) \<Rightarrow> \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>\<close> 
     using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
     by (simp add: fresh_GNil)
 
   let ?e = " (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2)))"
 
   show ?thesis proof(rule  subtype_let)
     show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> LET x = ?e IN s' \<Leftarrow> \<tau>" using assms by auto
     show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> ?e \<Rightarrow> t1" using 1 by auto
     show "\<Theta> ; \<Phi> ; {||} ; GNil ; \<Delta>  \<turnstile> [ [ L_num (n1 + n2) ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>" using 3 by auto
     show "\<Theta> ; {||} ; GNil  \<turnstile>  \<lbrace> z2 : B_int  | CE_val (V_var z2)  ==  CE_val (V_lit (L_num (n1+n2))) \<rbrace>  \<lesssim> t1" using subtype_bop_arith 
       by (metis "1" \<open>\<And>thesis. (\<And>z1. t1 = \<lbrace> z1 : B_int | [ [ z1 ]\<^sup>v ]\<^sup>c\<^sup>e == [ plus [ [ L_num n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ L_num n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e \<rbrace> \<Longrightarrow> thesis) \<Longrightarrow> thesis\<close> infer_e_wf(2) opp.distinct(1) type_for_lit.simps(3))
   qed
 
 qed
 
 lemma check_s_leq:
   assumes "\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> LET x = (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) IN s'  \<Leftarrow> \<tau>" 
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (if (n1 \<le> n2) then L_true else L_false))) IN s' \<Leftarrow> \<tau>"   
 proof -
   obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2)) \<Rightarrow> t1"
     using assms check_s_elims by metis
   then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_bool  | CE_val (V_var z1)  ==  CE_op LEq  ([V_lit (L_num n1)]\<^sup>c\<^sup>e) ([V_lit (L_num n2)]\<^sup>c\<^sup>e)  \<rbrace>"
     using infer_e_leq by auto
 
   obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace>\<close> 
     using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
       fresh_GNil 
     by simp
 
   show ?thesis proof(rule subtype_let)
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op LEq [ L_num n1 ]\<^sup>v [ L_num n2 ]\<^sup>v) s' \<Leftarrow> \<tau>\<close> using assms by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op LEq [ L_num n1 ]\<^sup>v [ L_num n2 ]\<^sup>v \<Rightarrow> t1\<close> using 1 by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> [ [ if n1 \<le> n2 then L_true else L_false ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace>\<close> using 3 by auto
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 \<le> n2) then L_true else L_false))) \<rbrace> \<lesssim> t1\<close> 
       using subtype_bop_arith[where opp=LEq] check_s_wf assms 2  
       by (metis opp.distinct(1) subtype_bop_arith type_l_eq)
   qed
 qed
 
 lemma check_s_eq:
   assumes "\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> LET x = (AE_op Eq (V_lit (n1)) (V_lit ( n2))) IN s'  \<Leftarrow> \<tau>" 
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x = (AE_val (V_lit (if (n1 = n2) then L_true else L_false))) IN s' \<Leftarrow> \<tau>"   
 proof -
   obtain t1 where 1: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Eq (V_lit (n1)) (V_lit (n2)) \<Rightarrow> t1"
     using assms check_s_elims by metis
   then obtain z1 where 2: "t1 =  \<lbrace> z1 : B_bool  | CE_val (V_var z1)  ==  CE_op Eq  ([V_lit (n1)]\<^sup>c\<^sup>e) ([V_lit (n2)]\<^sup>c\<^sup>e)  \<rbrace>"
     using infer_e_leq by auto
 
   obtain z2 where 3: \<open>\<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> AE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace>\<close> 
     using infer_v_form infer_e_valI infer_v_litI   infer_l.intros infer_e_wf 1 
       fresh_GNil 
     by simp
 
   show ?thesis proof(rule subtype_let)
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Eq [  n1 ]\<^sup>v [  n2 ]\<^sup>v) s' \<Leftarrow> \<tau>\<close> using assms by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_op Eq [  n1 ]\<^sup>v [  n2 ]\<^sup>v \<Rightarrow> t1\<close> using 1 by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> [ [ if n1 = n2 then L_true else L_false ]\<^sup>v ]\<^sup>e \<Rightarrow> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace>\<close> using 3 by auto
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z2 : B_bool  | CE_val (V_var z2)  ==  CE_val (V_lit ((if (n1 = n2) then L_true else L_false))) \<rbrace> \<lesssim> t1\<close> 
     proof -
       have " \<lbrace> z2 : B_bool  | [ [ z2 ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ eq [ [ n1 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ n2 ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  \<rbrace> = t1" using 2 
         by (metis \<tau>_fresh_c fresh_opp_all infer_l_form2 infer_l_fresh ms_fresh_all(31) ms_fresh_all(33) obtain_fresh_z type_e_eq type_l_eq)
       moreover have "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f GNil" using assms wfX_wfY by fastforce
       moreover have "base_for_lit n1 = base_for_lit n2" using 1 infer_e_wf wfE_elims(12) wfV_elims 
         by metis
       ultimately show ?thesis using subtype_bop_eq[OF \<open>\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f GNil\<close>, of n1 n2 z2] by auto     
     qed
   qed
 qed
 
 subsection \<open>Operators\<close>
 
 lemma preservation_plus:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) IN s' \<rangle> \<Leftarrow> \<tau>"        
   shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , LET x =  (AE_val (V_lit (L_num (n1+n2)))) IN s' \<rangle> \<Leftarrow> \<tau>"
 proof -
 
   have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Plus (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
     using assms config_type_elims by blast+
 
   hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  (L_num (n1+n2)))) s' \<Leftarrow> \<tau>" using check_s_plus assms by auto  
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (L_num (n1+n2))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
   then show ?thesis using dsim config_typeI 
     by (meson order_refl)
 qed
 
 lemma preservation_leq:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<rangle> \<Leftarrow> \<tau>"        
   shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit (((if (n1 \<le> n2) then L_true else L_false))))) s' \<rangle> \<Leftarrow> \<tau>"
 proof -
 
   have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op LEq (V_lit (L_num n1)) (V_lit (L_num n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
     using assms config_type_elims by blast+
 
   hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  ( ((if (n1 \<le> n2) then L_true else L_false))))) s' \<Leftarrow> \<tau>" using check_s_leq assms by auto  
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (((if (n1 \<le> n2) then L_true else L_false)))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
   then show ?thesis using dsim config_typeI 
     by (meson order_refl)
 qed
 
 lemma preservation_eq:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_op Eq (V_lit (n1)) (V_lit (n2))) s' \<rangle> \<Leftarrow> \<tau>"        
   shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit (((if (n1 = n2) then L_true else L_false))))) s' \<rangle> \<Leftarrow> \<tau>"
 proof -
 
   have tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_op Eq (V_lit (n1)) (V_lit (n2))) s' \<Leftarrow> \<tau>" and dsim: "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd:"(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
     using assms config_type_elims by blast+
 
   hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>AS_let x (AE_val (V_lit  ( ((if (n1 = n2) then L_true else L_false))))) s' \<Leftarrow> \<tau>" using check_s_eq assms by auto  
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val (V_lit ( (((if (n1 = n2) then L_true else L_false)))))) s' \<rangle> \<Leftarrow> \<tau>" using dsim config_typeI fd by presburger
   then show ?thesis using dsim config_typeI 
     by (meson order_refl)
 qed
 
 subsection \<open>Let Statements\<close>
 
 lemma subst_s_abs_lst:
   fixes s::s and sa::s and v'::v
   assumes "[[atom x]]lst. s = [[atom xa]]lst. sa" and "atom xa \<sharp> v \<and> atom x \<sharp> v"
   shows "s[x::=v]\<^sub>s\<^sub>v = sa[xa::=v]\<^sub>s\<^sub>v"
 proof -
   obtain c'::x where cdash: "atom c' \<sharp> (v, x, xa, s, sa)" using obtain_fresh by blast    
   moreover have " (x \<leftrightarrow> c') \<bullet> s = (xa \<leftrightarrow> c') \<bullet> sa" proof -
     have "atom c' \<sharp> (s, sa) \<and> atom c' \<sharp> (x, xa, s, sa)" using cdash by auto
     thus ?thesis using assms by auto
   qed
   ultimately show ?thesis using assms 
     using subst_sv_flip by auto 
 qed
 
 lemma check_let_val: 
   fixes v::v and s::s
   shows "\<Theta> ; \<Phi> ; B ; G ; \<Delta>  \<turnstile> ss \<Leftarrow> \<tau> \<Longrightarrow>  B = {||} \<Longrightarrow> G = GNil \<Longrightarrow> 
         ss = AS_let x (AE_val v) s \<or>  ss = AS_let2 x t (AS_val v) s \<Longrightarrow>  \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> (s[x::=v]\<^sub>s\<^sub>v) \<Leftarrow> \<tau>" and
     "check_branch_s \<Theta> \<Phi> \<B> GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
 proof(nominal_induct \<tau> and \<tau> and \<tau>  avoiding: v rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_letI x1 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s1 b c)
   hence *:"e = AE_val v" by auto
   let ?G = "(x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>"
   have "\<Theta> ; \<Phi> ; \<B> ;  ?G[x1::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x1::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s1[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x1::=v]\<^sub>\<tau>\<^sub>v" 
   proof(rule subst_infer_check_s(1))
     show **:\<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow>  \<lbrace> z : b  | c \<rbrace>\<close> using infer_e_elims check_letI * by fast
     thus \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile>  \<lbrace> z : b  | c \<rbrace> \<lesssim> \<lbrace> z : b  | c \<rbrace>\<close> using subtype_reflI  infer_v_wf by metis
     show \<open>atom z \<sharp> (x1, v)\<close> using check_letI fresh_Pair by auto
     show \<open>\<Theta> ; \<Phi> ; \<B> ; (x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<tau>\<close> using check_letI subst_defs by auto
     show "(x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x1, b, c[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" by auto
   qed
 
   hence "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s1[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"  using check_letI by auto
   moreover have " s1[x1::=v]\<^sub>s\<^sub>v =  s[x::=v]\<^sub>s\<^sub>v" 
     by (metis (full_types) check_letI fresh_GNil infer_e_elims(7) s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff(2) 
         subst_s_abs_lst wfG_x_fresh_in_v_simple)
 
   ultimately show ?case using check_letI by simp
 next
   case (check_let2I x1 \<Theta> \<Phi> \<B> \<Gamma> \<Delta> t s1 \<tau> s2 )
 
   hence s1eq:"s1 = AS_val v" by auto
   let ?G = "(x1, b_of t, c_of t x1) #\<^sub>\<Gamma> \<Gamma>"
   obtain z::x where *:"atom z \<sharp> (x1 , v,t)"  using obtain_fresh_z by metis
   hence teq:"t =  \<lbrace> z : b_of t | c_of t z \<rbrace>" using b_of_c_of_eq by auto
   have "\<Theta> ; \<Phi> ; \<B> ;  ?G[x1::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x1::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s2[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x1::=v]\<^sub>\<tau>\<^sub>v" 
   proof(rule subst_check_check_s(1))
     obtain t' where "\<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Rightarrow> t' \<and>  \<Theta> ; \<B> ; \<Gamma> \<turnstile> t' \<lesssim> t" using  check_s_elims(1) check_let2I(10) s1eq by auto
     thus  **:\<open> \<Theta> ; \<B> ; \<Gamma> \<turnstile> v \<Leftarrow> \<lbrace> z : b_of t | c_of t z \<rbrace>\<close> using  check_v.intros teq by auto
     show "atom z \<sharp> (x1, v)" using * by auto
     show \<open>  \<Theta> ; \<Phi> ; \<B> ; (x1, b_of t, c_of t x1) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<tau>\<close> using check_let2I by auto
     show "(x1, b_of t , c_of t x1) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x1, b_of t, (c_of t z)[z::=V_var x1]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" using append_g.simps c_of_switch * fresh_prodN by metis
   qed
 
   hence "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s2[x1::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"  using check_let2I by auto
   moreover have " s2[x1::=v]\<^sub>s\<^sub>v =  s[x::=v]\<^sub>s\<^sub>v" using
       check_let2I fresh_GNil check_s_elims s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff
       subst_s_abs_lst wfG_x_fresh_in_v_simple
   proof -
     have "AS_let2 x t (AS_val v) s = AS_let2 x1 t s1 s2"
       by (metis check_let2I.prems(3) s_branch_s_branch_list.distinct s_branch_s_branch_list.eq_iff(3)) (* 62 ms *)
     then show ?thesis
       by (metis (no_types) check_let2I check_let2I.prems(2) check_s_elims(1) fresh_GNil s_branch_s_branch_list.eq_iff(3) subst_s_abs_lst wfG_x_fresh_in_v_simple) (* 375 ms *)
   qed
 
   ultimately show ?case using check_let2I by simp
 qed(auto+)
 
 lemma preservation_let_val:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val v) s \<rangle> \<Leftarrow> \<tau> \<or> \<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x t (AS_val v) s \<rangle> \<Leftarrow> \<tau>" (is "?A \<or> ?B")
   shows " \<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>'  \<turnstile> \<langle> \<delta> , s[x::=v]\<^sub>s\<^sub>v \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'"
 proof -
   have tt:  "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and fd: "(\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
     using assms by blast+
 
   have  "?A \<or> ?B" using assms by auto
   then have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  s[x::=v]\<^sub>s\<^sub>v   \<Leftarrow> \<tau>"
   proof
     assume "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let x (AE_val v) s \<rangle> \<Leftarrow> \<tau>"
     hence * : " \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  AS_let x (AE_val v) s  \<Leftarrow> \<tau>" by blast
     thus ?thesis using check_let_val by simp
   next
     assume "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle> \<delta> , AS_let2 x t (AS_val v) s \<rangle> \<Leftarrow> \<tau>"
     hence * : "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile>  AS_let2 x t (AS_val v) s  \<Leftarrow> \<tau>" by blast
     thus ?thesis using check_let_val by simp
   qed
 
   thus  ?thesis using tt config_typeI fd
       order_refl by metis
 qed
 
 lemma check_s_fst_snd:
   assumes "fst_snd = AE_fst \<and> v=v1 \<or> fst_snd = AE_snd \<and> v=v2" 
     and   "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>"
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x ( AE_val v) s' \<Leftarrow> \<tau>"
 proof -
   have  1: \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>\<close> using assms by auto
 
   then obtain t1 where 2:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  (fst_snd (V_pair v1 v2)) \<Rightarrow> t1" using check_s_elims by auto
 
   show ?thesis using subtype_let 1 2 assms 
     by (meson infer_e_fst_pair infer_e_snd_pair)
 qed
 
 lemma preservation_fst_snd:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (fst_snd (V_pair v1 v2)) IN s' \<rangle> \<Leftarrow> \<tau>" and 
     "fst_snd = AE_fst \<and> v=v1 \<or> fst_snd = AE_snd \<and> v=v2"
   shows "\<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , LET x = (AE_val v) IN s' \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'"
 proof - 
   have  tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta>" using assms by blast
   hence t2: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (fst_snd (V_pair v1 v2)) s' \<Leftarrow> \<tau>" by auto
 
   moreover have "\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd" using assms config_type_elims by auto
   ultimately show ?thesis using config_typeI order_refl tt assms check_s_fst_snd by metis
 qed
 
 inductive_cases check_branch_s_elims2[elim!]:
   "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta>; tid ; cons ; const ; v \<turnstile> cs \<Leftarrow> \<tau>"
 
 lemmas freshers = freshers atom_dom.simps toSet.simps fresh_def x_not_in_b_set
 declare freshers [simp]
 
 lemma subtype_eq_if:
   fixes t::\<tau> and va::v
   assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b_of t  | c_of t z \<rbrace>" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
   shows   "\<Theta> ; \<B> ; \<Gamma> \<turnstile> \<lbrace> z : b_of t  | c_of t z \<rbrace>  \<lesssim> \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
 proof -
   obtain x::x where xf:"atom x \<sharp> ((\<Theta>, \<B>, \<Gamma>, z, c_of t z, z, c  IMP  c_of t z ),c)" using obtain_fresh by metis
 
   moreover have "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> (c  IMP  c_of t z )[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v " 
     unfolding subst_cv.simps 
   proof(rule valid_eq_imp)
 
     have "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f (c  IMP  (c_of t z))[z::=[ x ]\<^sup>v]\<^sub>v    " 
       apply(rule  wfT_wfC_cons)
       apply(simp add: assms, simp add: assms, unfold fresh_prodN )
       using  xf fresh_prodN by metis+     
     thus "\<Theta> ; \<B> ; (x, b_of t, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v  IMP  (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v " 
       using subst_cv.simps subst_defs by auto
   qed
 
   ultimately show ?thesis using subtype_baseI assms fresh_Pair subst_defs by metis
 qed
 
 lemma subtype_eq_if_\<tau>:
   fixes t::\<tau> and va::v
   assumes "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  t" and "\<Theta> ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> " and "atom z \<sharp> t"
   shows   "\<Theta> ; \<B> ; \<Gamma> \<turnstile> t  \<lesssim> \<lbrace> z : b_of t  | c  IMP c_of t z \<rbrace> "
 proof -
   have "t = \<lbrace> z : b_of t | c_of t z \<rbrace>" using b_of_c_of_eq assms by auto
   thus ?thesis  using subtype_eq_if assms  c_of.simps b_of.simps by metis
 qed
 
 lemma valid_conj:
   assumes  "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c1" and "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c2" 
   shows "\<Theta> ; \<B> ; \<Gamma> \<Turnstile> c1 AND c2" 
 proof
   show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1  AND  c2  \<close> using valid.simps wfC_conjI assms by auto
   show \<open>\<forall>i.  \<Theta> ; \<Gamma> \<turnstile> i \<and>  i \<Turnstile> \<Gamma>  \<longrightarrow>  i \<Turnstile> c1  AND  c2  \<close> 
   proof(rule+)
     fix i
     assume *:"\<Theta> ; \<Gamma> \<turnstile> i \<and> i \<Turnstile> \<Gamma> " 
     thus "i \<lbrakk> c1 \<rbrakk> ~ True" using assms valid.simps 
       using is_satis.cases by blast
     show "i \<lbrakk> c2 \<rbrakk> ~ True" using assms valid.simps 
       using is_satis.cases * by blast  
   qed
 qed
 
 subsection \<open>Other Statements\<close>
 
 lemma check_if:
   fixes s'::s and cs::branch_s and css::branch_list and v::v
   shows    "\<Theta>; \<Phi>; B; G; \<Delta> \<turnstile>  s' \<Leftarrow> \<tau> \<Longrightarrow> s' =  IF (V_lit ll) THEN s1 ELSE s2 \<Longrightarrow>  
         \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> G = GNil \<Longrightarrow> B = {||} \<Longrightarrow> ll = L_true \<and> s = s1 \<or> ll = L_false \<and> s = s2 \<Longrightarrow> 
         \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s \<Leftarrow> \<tau>" and
     "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
 proof(nominal_induct \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
   obtain z' where teq: "\<tau> = \<lbrace> z' : b_of \<tau> | c_of \<tau> z' \<rbrace> \<and> atom z' \<sharp> (z,\<tau>)" using obtain_fresh_z_c_of by metis
   hence ceq: "(c_of \<tau> z')[z'::=[ z ]\<^sup>v]\<^sub>c\<^sub>v = (c_of \<tau> z)" using c_of_switch fresh_Pair by metis
   have zf: " atom z \<sharp> c_of \<tau> z'"
     using c_of_fresh check_ifI teq fresh_Pair fresh_at_base by metis
   hence 1:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s \<Leftarrow>  \<lbrace> z : b_of \<tau>  | CE_val (V_lit ll)  ==  CE_val (V_lit ll)  IMP  c_of \<tau> z  \<rbrace>" using check_ifI by auto
   moreover have 2:"\<Theta> ; {||} ; GNil \<turnstile> (\<lbrace> z : b_of \<tau>  | CE_val (V_lit ll)  ==  CE_val (V_lit ll)  IMP  c_of \<tau> z  \<rbrace>) \<lesssim>  \<tau>" 
   proof - 
     have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> z : b_of \<tau>  | CE_val (V_lit ll )  ==  CE_val (V_lit ll)   IMP c_of \<tau> z  \<rbrace>)" using check_ifI check_s_wf by auto
     moreover have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>" using  check_s_wf check_ifI by auto
     ultimately show ?thesis using subtype_if_simp[of \<Theta> " {||}" z "b_of \<tau>" ll "c_of \<tau> z'" z'] using teq ceq zf subst_defs by metis
   qed
   ultimately show ?case  using check_s_supertype(1) check_ifI by metis
 qed(auto+)
 
 lemma preservation_if: 
   assumes  "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , IF (V_lit ll) THEN s1 ELSE s2 \<rangle> \<Leftarrow> \<tau>" and 
     "ll = L_true \<and> s = s1 \<or> ll = L_false \<and> s = s2"
   shows "\<Theta>; \<Phi>; \<Delta>  \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>  \<and> setD \<Delta> \<subseteq> setD \<Delta>"
 proof -
   have *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_if (V_lit ll) s1 s2 \<Leftarrow> \<tau> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using assms config_type_elims by metis
   hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s \<Leftarrow> \<tau>" using check_s_wf check_if assms by metis
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>  \<and> setD \<Delta> \<subseteq> setD \<Delta>" using config_typeI * 
     using assms(1) by blast
   thus ?thesis by blast
 qed
 
 lemma wfT_conj:
   assumes "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c1 \<rbrace>" and  "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c2 \<rbrace>"
   shows  "\<Theta> ; \<B> ; GNil \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c1 AND c2\<rbrace>"
 proof
   show \<open>atom z \<sharp> (\<Theta>, \<B>, GNil)\<close>
     apply(unfold fresh_prodN, intro conjI) 
     using wfTh_fresh wfT_wf assms apply metis
     using fresh_GNil x_not_in_b_set fresh_def by metis+   
   show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfT_elims assms by metis
   have "\<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c1" using wfT_wfC fresh_GNil assms by auto
   moreover have "\<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c2" using wfT_wfC fresh_GNil assms by auto
   ultimately show \<open> \<Theta> ; \<B> ; (z, b, TRUE) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f c1  AND  c2  \<close> using wfC_conjI by auto
 qed
 
 lemma subtype_conj:
   assumes    "\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c1 \<rbrace>" and   "\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c2 \<rbrace>" 
   shows   "\<Theta> ; \<B> ; GNil  \<turnstile> \<lbrace> z : b | c_of t z \<rbrace>  \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" 
 proof -
   have beq: "b_of t = b" using subtype_eq_base2 b_of.simps assms by metis
   obtain x::x where x:\<open>atom x \<sharp> (\<Theta>, \<B>, GNil, z, c_of t z, z, c1  AND  c2 )\<close> using obtain_fresh by metis
   thus ?thesis proof
     have "atom z \<sharp> t" using subtype_wf wfT_supp fresh_def x_not_in_b_set atom_dom.simps toSet.simps assms dom.simps by fastforce
     hence t:"t = \<lbrace> z : b_of t  | c_of t z \<rbrace>" using b_of_c_of_eq by auto
     thus  \<open> \<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c_of t z \<rbrace> \<close> using subtype_wf beq assms by auto
 
     show \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> (c1  AND  c2 )[z::=[ x ]\<^sup>v]\<^sub>v \<close>      
     proof -
       have \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> c1[z::=[ x ]\<^sup>v]\<^sub>v \<close>
       proof(rule subtype_valid)
         show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c1 \<rbrace>\<close> using assms by auto
         show \<open>atom x \<sharp> GNil\<close> using fresh_GNil by auto
         show \<open>t = \<lbrace> z : b  | c_of t z \<rbrace>\<close> using t beq by auto
         show \<open>\<lbrace> z : b  | c1 \<rbrace> = \<lbrace> z : b  | c1 \<rbrace>\<close> by auto
       qed
       moreover have \<open>\<Theta> ; \<B> ; (x, b, (c_of t z)[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> GNil  \<Turnstile> c2[z::=[ x ]\<^sup>v]\<^sub>v \<close>
       proof(rule subtype_valid)
         show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> t \<lesssim> \<lbrace> z : b | c2 \<rbrace>\<close> using assms by auto
         show \<open>atom x \<sharp> GNil\<close> using fresh_GNil by auto
         show \<open>t = \<lbrace> z : b  | c_of t z \<rbrace>\<close> using t beq by auto
         show \<open>\<lbrace> z : b  | c2 \<rbrace> = \<lbrace> z : b  | c2 \<rbrace>\<close> by auto
       qed
       ultimately show ?thesis unfolding subst_cv.simps subst_v_c_def  using valid_conj by metis
     qed
     thus \<open> \<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c1  AND  c2  \<rbrace> \<close> using subtype_wf wfT_conj assms by auto
   qed
 qed
 
 lemma infer_v_conj:
   assumes "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c1 \<rbrace>" and "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c2 \<rbrace>"
   shows "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b | c1 AND c2 \<rbrace>" 
 proof -
   obtain t1 where t1: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t1 \<and> \<Theta> ; \<B> ; GNil \<turnstile> t1 \<lesssim> \<lbrace> z : b | c1 \<rbrace>" 
     using assms check_v_elims by metis
   obtain t2 where t2: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t2 \<and> \<Theta> ; \<B> ; GNil \<turnstile> t2 \<lesssim> \<lbrace> z : b | c2 \<rbrace>" 
     using assms check_v_elims by metis
   have teq: "t1 = \<lbrace> z : b | c_of t1 z \<rbrace>" using subtype_eq_base2 b_of.simps 
     by (metis (full_types) b_of_c_of_eq fresh_GNil infer_v_t_wf t1 wfT_x_fresh)
   have "t1 = t2" using infer_v_uniqueness t1 t2 by auto
   hence " \<Theta> ; \<B> ; GNil \<turnstile> \<lbrace> z : b | c_of t1 z \<rbrace> \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" using subtype_conj t1 t2 by simp
   hence " \<Theta> ; \<B> ; GNil \<turnstile> t1 \<lesssim> \<lbrace> z : b | c1 AND c2 \<rbrace>" using teq by auto
   thus ?thesis using t1 using check_v.intros by auto
 qed
 
 lemma wfG_conj:
   fixes c1::c
   assumes  "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1 AND c2) #\<^sub>\<Gamma> \<Gamma>"
   shows "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1) #\<^sub>\<Gamma> \<Gamma>"
 proof(cases "c1 \<in> {TRUE, FALSE}")
   case True
   then show ?thesis using assms wfG_cons2I  wfG_elims wfX_wfY by metis
 next
   case False
   then show ?thesis using assms wfG_cons1I  wfG_elims wfX_wfY wfC_elims 
     by (metis wfG_elim2)
 qed
 
 lemma check_match:
   fixes s'::s and s::s and css::branch_list and cs::branch_s
   shows "\<Theta> ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>  s \<Leftarrow> \<tau> \<Longrightarrow> True" and
     "\<Theta> ; \<Phi> ; B ; G ; \<Delta> ; tid ; dc ; const  ;  vcons \<turnstile>  cs \<Leftarrow>  \<tau> \<Longrightarrow> 
              vcons = V_cons tid dc v \<Longrightarrow> B =  {||} \<Longrightarrow> G = GNil \<Longrightarrow> cs =  (dc x' \<Rightarrow> s') \<Longrightarrow>  
              \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> const \<Longrightarrow> 
              \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>" and
     "\<Theta> ; \<Phi> ; B ; G ; \<Delta> ; tid ; dclist ; vcons  \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> distinct (map fst dclist) \<Longrightarrow>
              vcons = V_cons tid dc v \<Longrightarrow> B =  {||} \<Longrightarrow> (dc, const) \<in> set dclist \<Longrightarrow> G = GNil \<Longrightarrow> 
              Some (AS_branch dc x' s') = lookup_branch dc css \<Longrightarrow> \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> const \<Longrightarrow> 
              \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>"
 proof(nominal_induct \<tau> and \<tau> and \<tau> avoiding: x' v  rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid consa consta va cs \<tau> dclist cssa)
 
   then obtain xa and sa where cseq:"cs = AS_branch consa xa sa" using check_branch_s_elims2[OF check_branch_list_consI(1)] by metis
 
   show ?case proof(cases "dc = consa")
     case True
     hence "cs = AS_branch consa x' s'" using check_branch_list_consI cseq 
       by (metis lookup_branch.simps(2) option.inject)
     moreover have "const = consta" using check_branch_list_consI distinct.simps 
       by (metis True dclist_distinct_unique list.set_intros(1))
     moreover have "va = V_cons tid consa v" using check_branch_list_consI True by auto
     ultimately  show ?thesis using check_branch_list_consI  by auto
   next
     case False
     hence "Some (AS_branch dc x' s') = lookup_branch dc cssa" using lookup_branch.simps(2) check_branch_list_consI(10) cseq by auto
     moreover have "(dc, const) \<in> set dclist" using check_branch_list_consI False by simp
     ultimately show ?thesis using check_branch_list_consI by auto
   qed
 
 next
   case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const va cs \<tau>)
   hence " cs = AS_branch cons x' s'" using lookup.simps check_branch_list_finalI lookup_branch.simps option.inject 
     by (metis map_of.simps(1) map_of_Cons_code(2) option.distinct(1) s_branch_s_branch_list.exhaust(2) weak_map_of_SomeI)
   then show ?case using check_branch_list_finalI by auto
 next
   case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons va s)
 
   text \<open>Supporting facts here to make the main body of the proof concise\<close>
   have xf:"atom x \<sharp> \<tau>" proof -
     have "supp \<tau> \<subseteq> supp  \<B>" using wf_supp(4) check_branch_s_branchI  atom_dom.simps toSet.simps dom.simps by fastforce
     thus ?thesis using fresh_def x_not_in_b_set by blast
   qed
 
   hence "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>" using forget_subst_v subst_v_\<tau>_def by auto
   have "\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v = \<Delta>" using forget_subst_dv  wfD_x_fresh fresh_GNil check_branch_s_branchI by metis
 
   have "supp v = {}" using check_branch_s_branchI check_v_wf wfV_supp_nil by metis
   hence "supp va = {}" using \<open> va = V_cons tid cons v\<close> v.supp pure_supp by auto
 
   let ?G = "(x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const x ) #\<^sub>\<Gamma> \<Gamma>"
   obtain z::x where z: "const = \<lbrace> z : b_of const | c_of const z \<rbrace> \<and> atom z \<sharp> (x', v,x,const,va)" 
     using obtain_fresh_z_c_of by metis
 
   have  vt: \<open>\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  AND c_of const z \<rbrace>\<close>
   proof(rule infer_v_conj)
     obtain t' where t: "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Rightarrow> t' \<and> \<Theta> ; \<B> ; GNil \<turnstile> t' \<lesssim> const" 
       using check_v_elims check_branch_s_branchI by metis
     show "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>"        
     proof(rule check_v_top)
 
       show "\<Theta> ; \<B> ; GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> "     
 
       proof(rule wfG_wfT)
         show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e    )[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil \<close>
         proof -
           have 1: "va[z::=[ x ]\<^sup>v]\<^sub>v\<^sub>v  = va" using  forget_subst_v subst_v_v_def  z fresh_prodN by metis
           moreover have 2: "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e   AND  c_of const x ) #\<^sub>\<Gamma> GNil  "
             using    check_branch_s_branchI(17)[THEN check_s_wf] \<open>\<Gamma> = GNil\<close> by auto      
           moreover hence "\<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b_of const, [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ x ]\<^sup>v ]\<^sup>c\<^sup>e ) #\<^sub>\<Gamma> GNil" 
             using wfG_conj by metis
           ultimately show ?thesis
             unfolding subst_cv.simps subst_cev.simps subst_vv.simps by auto
         qed      
         show \<open>atom x \<sharp> ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   )\<close> unfolding c.fresh ce.fresh v.fresh
           apply(intro conjI )        
           using  check_branch_s_branchI fresh_at_base z freshers apply simp
           using  check_branch_s_branchI fresh_at_base z freshers apply simp
           using pure_supp apply force
           using z fresh_x_neq fresh_prod5 by metis        
       qed
       show \<open>[ va ]\<^sup>c\<^sup>e = [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e[z::=v]\<^sub>c\<^sub>e\<^sub>v\<close> 
         using \<open> va = V_cons tid cons v\<close> subst_cev.simps subst_vv.simps by auto
       show \<open> \<Theta> ; \<B> ; GNil \<turnstile> v \<Leftarrow> const \<close> using check_branch_s_branchI by auto
       show "supp [ va ]\<^sup>c\<^sup>e \<subseteq> supp \<B>" using \<open>supp va = {}\<close> ce.supp by simp
     qed
     show "\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | c_of const z \<rbrace>" 
       using check_branch_s_branchI z by auto
   qed
 
   text \<open>Main body of proof for this case\<close>
   have "\<Theta> ; \<Phi> ; \<B> ; (?G)[x::=v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v  \<turnstile> s[x::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
   proof(rule subst_check_check_s)
     show \<open>\<Theta> ; \<B> ; GNil  \<turnstile> v \<Leftarrow> \<lbrace> z : b_of const  | [ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const z \<rbrace>\<close> using vt by auto
     show \<open>atom z \<sharp> (x, v)\<close> using z fresh_prodN by auto
     show \<open> \<Theta> ; \<Phi> ; \<B> ; ?G ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> 
       using check_branch_s_branchI by auto
 
     show \<open> ?G = GNil @ (x, b_of const, ([ va ]\<^sup>c\<^sup>e  ==  [ V_cons tid cons [ z ]\<^sup>v ]\<^sup>c\<^sup>e   AND c_of const z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil\<close>      
     proof -
       have "va[z::=[ x ]\<^sup>v]\<^sub>v\<^sub>v  = va" using  forget_subst_v subst_v_v_def  z fresh_prodN by metis
       moreover have  "(c_of const z)[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v = c_of const x" 
         using  c_of_switch[of z const x]  z fresh_prodN by metis
       ultimately show ?thesis
         unfolding subst_cv.simps subst_cev.simps subst_vv.simps append_g.simps         
         using c_of_switch[of z const x]  z fresh_prodN z fresh_prodN  check_branch_s_branchI by argo
     qed
   qed
   moreover have "s[x::=v]\<^sub>s\<^sub>v = s'[x'::=v]\<^sub>s\<^sub>v" 
     using check_branch_s_branchI subst_v_flip_eq_two subst_v_s_def s_branch_s_branch_list.eq_iff by metis
   ultimately show  ?case using  check_branch_s_branchI \<open>\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>\<close> \<open>\<Delta>[x::=v]\<^sub>\<Delta>\<^sub>v = \<Delta>\<close> by auto
 qed(auto+)
 
 text \<open>Lemmas for while reduction. Making these separate lemmas allows flexibility in wiring them into the main proof and robustness
 if we change it\<close>
 
 lemma check_unit:
   fixes \<tau>::\<tau> and \<Phi>::\<Phi> and \<Delta>::\<Delta> and G::\<Gamma>
   assumes "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z : B_unit  | TRUE \<rbrace> \<lesssim> \<tau>'" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>"  and "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>"  and "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f G"
   shows \<open> \<Theta> ; \<Phi> ; {||} ; G ; \<Delta>  \<turnstile> [[ L_unit ]\<^sup>v]\<^sup>s \<Leftarrow> \<tau>'\<close>
 proof - 
   have *:"\<Theta> ; {||} ; GNil  \<turnstile> [L_unit]\<^sup>v \<Rightarrow> \<lbrace> z : B_unit  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_unit ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>" 
     using infer_l.intros(4) infer_v_litI fresh_GNil assms  wfX_wfY   by (meson subtype_g_wf)
   moreover have "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> z : B_unit  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_unit ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<lesssim> \<tau>'" 
     using subtype_top subtype_trans * infer_v_wf 
     by (meson assms(1))
   ultimately show ?thesis (*apply(rule check_valI, auto simp add: assms,rule * )*)
     using subtype_top subtype_trans fresh_GNil assms check_valI assms check_s_g_weakening assms toSet.simps 
     by (metis bot.extremum infer_v_g_weakening subtype_weakening wfD_wf)
 qed
 
 lemma preservation_var:
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> VAR u : \<tau>' = v IN s \<Leftarrow> \<tau> \<Longrightarrow> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<Longrightarrow> atom u \<sharp> \<delta> \<Longrightarrow> atom u \<sharp> \<Delta> \<Longrightarrow>
          \<Theta>; \<Phi>; {||}; GNil; (u,\<tau>')#\<^sub>\<Delta>\<Delta>  \<turnstile> s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> (u,v)#\<delta> \<sim> (u,\<tau>')#\<^sub>\<Delta>\<Delta>"
     and
     "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
 proof(nominal_induct  "{||}::bv fset" GNil \<Delta> "VAR u : \<tau>' = v IN s" \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_varI u' \<Theta> \<Phi> \<Delta> \<tau> s')
   hence "\<Theta>; \<Phi>; {||}; GNil; (u, \<tau>') #\<^sub>\<Delta> \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" using check_s_abs_u check_v_wf by metis
 
   moreover have "\<Theta> \<turnstile> ((u,v)#\<delta>) \<sim> ((u,\<tau>')#\<^sub>\<Delta>\<Delta>)" proof
     show \<open>\<Theta>  \<turnstile> \<delta> \<sim> \<Delta> \<close> using check_varI by auto
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> \<tau>'\<close> using check_varI by auto
     show \<open>u \<notin> fst ` set \<delta>\<close> using check_varI fresh_d_fst_d by auto
   qed
 
   ultimately show ?case by simp
 qed(auto+)
 
 lemma check_while:
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> WHILE s1 DO { s2 }  \<Leftarrow> \<tau> \<Longrightarrow> atom x \<sharp> (s1, s2) \<Longrightarrow>  atom z' \<sharp> x \<Longrightarrow>
        \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> LET x : (\<lbrace> z' : B_bool  | TRUE \<rbrace>) = s1 IN (IF (V_var x) THEN (s2 ;; (WHILE s1 DO {s2}))  
             ELSE ([ V_lit L_unit]\<^sup>s))  \<Leftarrow> \<tau>" and
     "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "check_branch_list \<Theta> \<Phi>  {||} \<Gamma> \<Delta> tid dclist v css \<tau> \<Longrightarrow> True"
 proof(nominal_induct  "{||}::bv fset" GNil \<Delta> "AS_while s1 s2" \<tau> and \<tau> and \<tau>  avoiding: s1 s2 x z' rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_whileI \<Theta> \<Phi> \<Delta> s1 z s2 \<tau>')
   have teq:"\<lbrace> z' : B_bool  | TRUE \<rbrace> = \<lbrace> z : B_bool  | TRUE \<rbrace>" using \<tau>.eq_iff by auto
 
   show ?case proof
     have " atom x \<sharp> \<tau>' " using wfT_nil_supp fresh_def subtype_wfT check_whileI(5) by fast
     moreover have "atom x \<sharp> \<lbrace> z' : B_bool  | TRUE \<rbrace> " using \<tau>.fresh c.fresh b.fresh by metis  
     ultimately show \<open>atom x \<sharp> (\<Theta>, \<Phi>,  {||}, GNil, \<Delta>, \<lbrace> z' : B_bool  | TRUE \<rbrace>, s1, \<tau>')\<close>
       apply(unfold fresh_prodN)  
       using check_whileI  wb_x_fresh check_s_wf wfD_x_fresh fresh_empty_fset fresh_GNil fresh_Pair \<open>atom x \<sharp> \<tau>'\<close>  by metis
 
     show \<open> \<Theta> ; \<Phi> ;  {||} ; GNil ; \<Delta>  \<turnstile> s1 \<Leftarrow> \<lbrace> z' : B_bool  | TRUE \<rbrace>\<close> using check_whileI  teq by metis
 
     let ?G =  "(x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x) #\<^sub>\<Gamma> GNil"
 
     have cof:"(c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x) = C_true" using c_of.simps check_whileI subst_cv.simps by metis
     have  wfg: "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f ?G" proof 
       show "c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x \<in> {TRUE, FALSE}" using subst_cv.simps cof by auto
       show "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f GNil " using wfG_nilI check_whileI wfX_wfY check_s_wf by metis
       show "atom x \<sharp> GNil" using fresh_GNil by auto
       show "\<Theta> ;  {||} \<turnstile>\<^sub>w\<^sub>f b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>  " using wfB_boolI wfX_wfY check_s_wf b_of.simps 
         by (metis \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>)
     qed
 
     obtain zz::x where zf:\<open>atom zz \<sharp> ((\<Theta>, \<Phi>, {||}::bv fset, ?G , \<Delta>, [ x ]\<^sup>v, 
                                   AS_seq s2 (AS_while s1 s2), AS_val [ L_unit ]\<^sup>v, \<tau>'),x,?G)\<close>
       using obtain_fresh by blast
     show \<open> \<Theta> ; \<Phi> ;  {||} ; ?G ; \<Delta>  \<turnstile> 
                    AS_if [ x ]\<^sup>v (AS_seq s2 (AS_while s1 s2)) (AS_val [ L_unit ]\<^sup>v) \<Leftarrow> \<tau>'\<close> 
     proof      
       show "atom zz \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, ?G , \<Delta>, [ x ]\<^sup>v, AS_seq s2 (AS_while s1 s2), AS_val [ L_unit ]\<^sup>v, \<tau>')" using zf by auto
       show \<open>\<Theta> ; {||} ; ?G  \<turnstile> [ x ]\<^sup>v \<Leftarrow> \<lbrace> zz : B_bool  | TRUE \<rbrace>\<close> proof
         have "atom zz \<sharp> x \<and> atom zz \<sharp> (\<Theta>,  {||}::bv fset, ?G)" using zf fresh_prodN by metis
         thus \<open> \<Theta> ; {||} ; ?G  \<turnstile> [ x ]\<^sup>v \<Rightarrow>\<lbrace> zz : B_bool |  [[zz]\<^sup>v]\<^sup>c\<^sup>e == [[ x ]\<^sup>v]\<^sup>c\<^sup>e  \<rbrace>\<close> 
           using infer_v_varI lookup.simps wfg b_of.simps by metis
         thus  \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<lbrace> zz : B_bool |  [[ zz ]\<^sup>v]\<^sup>c\<^sup>e == [[ x ]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>  \<lesssim> \<lbrace> zz : B_bool  | TRUE \<rbrace>\<close>
           using subtype_top infer_v_wf by metis
       qed 
       show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_seq s2 (AS_while s1 s2) \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
       proof 
         have "\<lbrace> zz : B_unit  | TRUE \<rbrace> = \<lbrace> z : B_unit  | TRUE \<rbrace>" using \<tau>.eq_iff by auto 
         thus \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> s2 \<Leftarrow> \<lbrace> zz : B_unit  | TRUE \<rbrace>\<close> using check_s_g_weakening(1) [OF check_whileI(3) _ wfg] toSet.simps 
           by (simp add: \<open>\<lbrace> zz : B_unit | TRUE \<rbrace> = \<lbrace> z : B_unit | TRUE \<rbrace>\<close>)
 
         show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close>
         proof(rule check_s_supertype(1))
           have \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<tau>'\<close> using  check_whileI by auto
           thus *:\<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_while s1 s2 \<Leftarrow> \<tau>' \<close> using  check_s_g_weakening(1)[OF _ _ wfg] toSet.simps by auto
 
           show \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<tau>'  \<lesssim> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
           proof(rule subtype_eq_if_\<tau>)
             show \<open> \<Theta> ; {||} ; ?G \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using * check_s_wf by auto
             show \<open> \<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace> \<close>
               apply(rule wfT_eq_imp, simp add: base_for_lit.simps)
               using subtype_wf check_whileI wfg zf fresh_prodN by metis+
             show \<open>atom zz \<sharp> \<tau>'\<close> using  zf fresh_prodN by metis
           qed
         qed
 
       qed
       show \<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_val [ L_unit ]\<^sup>v \<Leftarrow> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close>
       proof(rule check_s_supertype(1))
 
         show *:\<open> \<Theta> ; \<Phi> ; {||} ; ?G ; \<Delta>  \<turnstile> AS_val [ L_unit ]\<^sup>v \<Leftarrow> \<tau>'\<close> 
           using check_unit[OF check_whileI(5) _ _ wfg] using check_whileI wfg wfX_wfY check_s_wf by metis
         show \<open>\<Theta> ; {||} ; ?G  \<turnstile> \<tau>' \<lesssim> \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>\<close> 
         proof(rule subtype_eq_if_\<tau>)
           show \<open> \<Theta> ; {||} ; ?G \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> using * check_s_wf by metis
           show \<open> \<Theta> ; {||} ; ?G  \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_false ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace> \<close>                          
             apply(rule wfT_eq_imp, simp add: base_for_lit.simps)
             using subtype_wf check_whileI wfg zf fresh_prodN by metis+
           show \<open>atom zz \<sharp> \<tau>'\<close> using  zf fresh_prodN by metis
         qed
       qed
     qed
   qed
 qed(auto+)
 
 lemma check_s_narrow:
   fixes s::s and x::x
   assumes "atom x \<sharp> (\<Theta>, \<Phi>, \<B>, \<Gamma>, \<Delta>, c, \<tau>, s)" and "\<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>" and    
     "\<Theta> ; \<B> ; \<Gamma>  \<Turnstile> c "
   shows "\<Theta> ; \<Phi> ; \<B> ;  \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>"
 proof -
   let ?B = "({||}::bv fset)"
   let ?v = "V_lit L_true"
 
   obtain z::x where z: "atom z \<sharp> (x, [ L_true ]\<^sup>v,c)" using obtain_fresh by metis
 
   have "atom z \<sharp> c" using z fresh_prodN by auto
   hence c:"  c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v = c" using  subst_v_c_def by simp
 
   have "\<Theta> ; \<Phi> ; \<B> ; ((x,B_bool, c) #\<^sub>\<Gamma> \<Gamma>)[x::=?v]\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=?v]\<^sub>\<Delta>\<^sub>v   \<turnstile>  s[x::=?v]\<^sub>s\<^sub>v   \<Leftarrow> \<tau>[x::=?v]\<^sub>\<tau>\<^sub>v" proof(rule  subst_infer_check_s(1) )
     show vt: \<open> \<Theta> ; \<B> ; \<Gamma>  \<turnstile> [ L_true ]\<^sup>v \<Rightarrow> \<lbrace> z : B_bool | (CE_val (V_var z)) == (CE_val (V_lit  L_true )) \<rbrace>   \<close> 
       using infer_v_litI check_s_wf wfG_elims(2) infer_trueI assms by metis     
     show \<open>\<Theta> ; \<B> ; \<Gamma>  \<turnstile> \<lbrace> z : B_bool | (CE_val (V_var z)) == (CE_val (V_lit  L_true )) \<rbrace> \<lesssim> \<lbrace> z : B_bool  | c[x::=[ z ]\<^sup>v]\<^sub>v \<rbrace>\<close> proof
       show \<open>atom x \<sharp> (\<Theta>, \<B>, \<Gamma>, z, [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e , z, c[x::=[ z ]\<^sup>v]\<^sub>v)\<close> 
         apply(unfold fresh_prodN, intro conjI) 
         prefer 5
         using c.fresh ce.fresh v.fresh z fresh_prodN apply auto[1]
         prefer 6
         using fresh_subst_v_if[of "atom x" c x] assms fresh_prodN apply simp
         using z assms fresh_prodN apply metis
         using z  assms fresh_prodN apply metis
         using z assms  fresh_prodN apply metis
         using z fresh_prodN assms fresh_at_base by metis+
       show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_bool  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace> \<close> using vt infer_v_wf by simp
       show \<open> \<Theta> ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : B_bool  | c[x::=[ z ]\<^sup>v]\<^sub>v \<rbrace> \<close> proof(rule wfG_wfT)    
         show \<open> \<Theta> ; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma> \<close> using c check_s_wf assms by metis
         have " atom x \<sharp> [ z ]\<^sup>v" using v.fresh z fresh_at_base by auto
         thus  \<open>atom x \<sharp> c[x::=[ z ]\<^sup>v]\<^sub>v\<close> using fresh_subst_v_if[of "atom x" c ] by auto
       qed
       have wfg: "\<Theta> ; \<B> \<turnstile>\<^sub>w\<^sub>f(x, B_bool, ([ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>" 
         using wfT_wfG vt infer_v_wf fresh_prodN assms by simp
       show  \<open>\<Theta> ; \<B> ; (x, B_bool, ([ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e )[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>  \<Turnstile> c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>v \<close> 
         using c valid_weakening[OF assms(3) _ wfg ] toSet.simps 
         using subst_v_c_def by auto
     qed
     show \<open>atom z \<sharp> (x, [ L_true ]\<^sup>v)\<close> using z fresh_prodN by metis
     show \<open> \<Theta> ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile> s \<Leftarrow> \<tau>\<close> using assms by auto
 
     thus \<open>(x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> = GNil @ (x, B_bool, c[x::=[ z ]\<^sup>v]\<^sub>v[z::=[ x ]\<^sup>v]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>\<close> using append_g.simps c by auto
   qed
 
   moreover have "((x,B_bool, c) #\<^sub>\<Gamma> \<Gamma>)[x::=?v]\<^sub>\<Gamma>\<^sub>v = \<Gamma> " using subst_gv.simps by auto
   ultimately show ?thesis using assms forget_subst_dv forget_subst_sv forget_subst_tv fresh_prodN  by metis
 qed
 
 lemma check_assert_s:
   fixes s::s and x::x
   assumes "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s  \<Leftarrow> \<tau>"
   shows "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s  \<Leftarrow> \<tau> \<and> \<Theta> ; {||} ; GNil  \<Turnstile> c "
 proof -
   let ?B = "({||}::bv fset)"
   let ?v = "V_lit L_true"
 
   obtain x where x: "\<Theta> ; \<Phi> ; ?B ; (x,B_bool, c) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile>  s  \<Leftarrow> \<tau> \<and> atom x \<sharp> (\<Theta>, \<Phi>, ?B, GNil, \<Delta>, c, \<tau>, s ) \<and> \<Theta> ; ?B ; GNil \<Turnstile> c " 
     using check_s_elims(10)[OF \<open>\<Theta> ; \<Phi> ; ?B ; GNil ; \<Delta>  \<turnstile>  AS_assert c s   \<Leftarrow> \<tau>\<close>] valid.simps by metis
 
   show ?thesis using assms check_s_narrow x by metis
 qed
 
 lemma infer_v_pair2I:
   "atom z \<sharp> (v1, v2) \<Longrightarrow>
    atom z \<sharp> (\<Theta>, \<B>, \<Gamma>) \<Longrightarrow>
    \<Theta> ; \<B> ; \<Gamma> \<turnstile> v1 \<Rightarrow> t1 \<Longrightarrow>
    \<Theta> ; \<B> ; \<Gamma> \<turnstile> v2 \<Rightarrow> t2 \<Longrightarrow>
    b1 = b_of t1 \<Longrightarrow> b2 = b_of t2 \<Longrightarrow> 
   \<Theta> ; \<B> ; \<Gamma> \<turnstile> [ v1 , v2 ]\<^sup>v \<Rightarrow> \<lbrace> z : [ b1 , b2 ]\<^sup>b  | [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ v1 , v2 ]\<^sup>v ]\<^sup>c\<^sup>e  \<rbrace>"
   using infer_v_pairI by simp
 
 subsection \<open>Main Lemma\<close>
 
 lemma preservation: 
   assumes "\<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>" and "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>"
   shows "\<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle>\<delta>', s'\<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
   using assms 
 proof(induct arbitrary: \<tau> rule: reduce_stmt.induct)
   case (reduce_let_plusI \<delta> x n1 n2 s')
   then show ?case using preservation_plus
     by (metis order_refl)  
 next
   case (reduce_let_leqI b n1 n2 \<delta> x s) 
   then show ?case using preservation_leq  by (metis order_refl)  
 next
   case (reduce_let_eqI b n1 n2 \<Phi> \<delta> x s)
   then show ?case using preservation_eq[OF reduce_let_eqI(2)] order_refl by metis
 next
   case (reduce_let_appI f z b c \<tau>' s' \<Phi> \<delta> x v s)
   hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_app f v) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let_appI(2)] by metis 
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_app f v) s \<Leftarrow> \<tau>" by auto
 
   hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x   (\<tau>'[z::=v]\<^sub>\<tau>\<^sub>v) (s'[z::=v]\<^sub>s\<^sub>v) s \<Leftarrow> \<tau>" 
     using preservation_app reduce_let_appI tt by auto
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x (\<tau>'[z::=v]\<^sub>\<tau>\<^sub>v) s'[z::=v]\<^sub>s\<^sub>v s \<rangle> \<Leftarrow> \<tau>"  using  config_typeI tt by auto
   then show ?case using tt order_refl reduce_let_appI by metis
 
 next
   case (reduce_let_appPI f bv z b c \<tau>' s' \<Phi> \<delta> x b' v s)
 
   hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let_appPI(2)] by metis 
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau>" by auto
 
   have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x   (\<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b[z::=v]\<^sub>\<tau>\<^sub>v) (s'[bv::=b']\<^sub>s\<^sub>b[z::=v]\<^sub>s\<^sub>v) s \<Leftarrow> \<tau>" 
   proof(rule preservation_poly_app) 
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ z b c  \<tau>' s'))) = lookup_fun \<Phi> f\<close> using reduce_let_appPI by metis
     show \<open>\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd\<close> using tt lookup_fun_member by metis
     show \<open> \<Theta> ; \<Phi> ;{||} ; GNil ; \<Delta>  \<turnstile> AS_let x (AE_appP f b' v) s \<Leftarrow> \<tau>\<close> using * by auto
     show \<open> \<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f b' \<close> using check_s_elims infer_e_wf wfE_elims * by metis
   qed(auto+)
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , AS_let2 x (\<tau>'[bv::=b']\<^sub>\<tau>\<^sub>b[z::=v]\<^sub>\<tau>\<^sub>v) s'[bv::=b']\<^sub>s\<^sub>b[z::=v]\<^sub>s\<^sub>v s \<rangle> \<Leftarrow> \<tau>"  using  config_typeI tt by auto
   then show ?case using tt order_refl reduce_let_appI by metis
 
 next
   case (reduce_if_trueI \<delta> s1 s2) 
   then show ?case using preservation_if by metis
 next
   case (reduce_if_falseI uw \<delta> s1 s2)
   then show ?case using preservation_if by metis
 next
   case (reduce_let_valI \<delta> x v s)
   then show ?case using preservation_let_val by presburger
 next
   case (reduce_let_mvar u v \<delta> \<Phi>  x s)
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_mvar u) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by blast
 
   hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_mvar u) s \<Leftarrow> \<tau>" by auto
   obtain xa::x and za::x and ca::c and ba::b and sa::s where
     sa1: "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_mvar u, \<tau>) \<and>  atom za \<sharp> (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_mvar u, \<tau>, sa) \<and>
      \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_mvar u \<Rightarrow> \<lbrace> za : ba  | ca \<rbrace> \<and>
      \<Theta> ; \<Phi> ; {||} ; (xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau> \<and>
        (\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (x, xa, s, sa) \<longrightarrow> (x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa)" 
     using check_s_elims(2)[OF **] subst_defs by metis
 
   have "\<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow>  \<lbrace> za : ba  | ca \<rbrace>" proof -
     have " (u , \<lbrace> za : ba  | ca \<rbrace>) \<in> setD \<Delta>" using infer_e_elims(11) sa1 by fast
     thus  ?thesis using delta_sim_v reduce_let_mvar config_type_elims check_s_wf  by metis
   qed
 
   then obtain \<tau>' where  vst: "\<Theta> ; {||} ; GNil \<turnstile> v \<Rightarrow> \<tau>' \<and>
         \<Theta> ; {||} ; GNil \<turnstile> \<tau>'  \<lesssim>  \<lbrace> za : ba  | ca \<rbrace>" using check_v_elims by blast
 
   obtain za2 and ba2 and ca2 where  zbc: "\<tau>' = (\<lbrace> za2 : ba2 | ca2 \<rbrace>) \<and> atom za2 \<sharp> (xa, (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>, sa))"
     using obtain_fresh_z by blast
   have beq: "ba=ba2" using subtype_eq_base vst zbc by blast
 
   moreover have xaf: "atom xa \<sharp> (za, za2)" 
     apply(unfold fresh_prodN, intro conjI)
     using sa1 zbc fresh_prodN fresh_x_neq by metis+
 
   have sat2: " \<Theta> ; \<Phi> ; {||} ; GNil@(xa, ba, ca2[za2::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau>" proof(rule ctx_subtype_s)
     show "\<Theta> ; \<Phi> ; {||} ; GNil @ (xa, ba, ca[za::=V_var xa]\<^sub>c\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>  \<turnstile> sa \<Leftarrow> \<tau>" using sa1 by auto
     show "\<Theta> ; {||} ; GNil  \<turnstile> \<lbrace> za2 : ba  | ca2 \<rbrace> \<lesssim> \<lbrace> za : ba  | ca \<rbrace>" using beq zbc vst by fast
     show "atom xa \<sharp> (za, za2, ca, ca2)" proof -
       have *:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> za2 : ba2 | ca2 \<rbrace>) " using zbc vst subtype_wf by auto
       hence "supp ca2 \<subseteq> { atom za2 }" using wfT_supp_c[OF *] supp_GNil by simp
       moreover have "atom za2 \<sharp> xa" using zbc fresh_Pair fresh_x_neq by metis
       ultimately have  "atom xa \<sharp> ca2" using zbc supp_at_base fresh_def 
         by (metis empty_iff singleton_iff subset_singletonD)
       moreover have "atom xa \<sharp> ca" proof -
         have *:"\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f (\<lbrace> za : ba | ca \<rbrace>) " using zbc vst subtype_wf by auto
         hence "supp ca \<subseteq> { atom za }" using wfT_supp \<tau>.supp by force
         moreover have "xa \<noteq> za"  using   fresh_def fresh_x_neq xaf fresh_Pair by metis
         ultimately show ?thesis using fresh_def by auto
       qed
       ultimately show ?thesis using xaf sa1 fresh_prod4 fresh_Pair by metis
     qed
   qed
   hence dwf: "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>" using sa1 infer_e_wf by meson
 
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let xa (AE_val v) sa \<Leftarrow> \<tau>" proof 
     have "atom xa \<sharp> (AE_val v)" using infer_v_wf(1) wfV_supp fresh_def e.fresh x_not_in_b_set vst by fastforce
     thus  "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>)" using sa1 freshers by simp 
     have "atom za2 \<sharp> (AE_val v)" using infer_v_wf(1) wfV_supp fresh_def e.fresh x_not_in_b_set vst by fastforce
     thus "atom za2 \<sharp> (xa, \<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, AE_val v, \<tau>, sa)" using zbc freshers fresh_prodN by auto
     have " \<Theta>    \<turnstile>\<^sub>w\<^sub>f \<Phi>" using sa1 infer_e_wf by auto
     thus  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val v \<Rightarrow> \<lbrace> za2 : ba  | ca2 \<rbrace>" 
       using zbc vst beq dwf infer_e_valI by blast
     show "\<Theta> ; \<Phi> ; {||} ; (xa, ba, ca2[za2::=V_var xa]\<^sub>v) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> sa \<Leftarrow> \<tau>" using sat2 append_g.simps subst_defs by metis
   qed
   moreover have  "AS_let xa (AE_val v) sa =  AS_let x (AE_val v) s" proof -
     have "[[atom x]]lst. s = [[atom xa]]lst. sa" 
       using sa1 Abs1_eq_iff_all(3)[where z=" (s, sa)"] by metis
     thus ?thesis using s_branch_s_branch_list.eq_iff(2) by metis
   qed
   ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let x (AE_val v) s \<Leftarrow> \<tau>"  by auto
 
   then show ?case using reduce_let_mvar * config_typeI
     by (meson order_refl)
 next
   case (reduce_let2I \<Phi> \<delta> s1 \<delta>' s1'  x t s2)
   hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let2 x t s1 s2  \<Leftarrow> \<tau>  \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" using config_type_elims[OF reduce_let2I(3)] by blast
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let2 x t s1 s2  \<Leftarrow> \<tau>" by auto
 
   obtain xa::x and  z::x and c and b and s2a::s where st: "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>, t, s1, \<tau>)  \<and>
        \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> s1 \<Leftarrow> t \<and>
        \<Theta> ; \<Phi> ; {||} ; (xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil ; \<Delta>   \<turnstile> s2a \<Leftarrow> \<tau> \<and>  ([[atom x]]lst. s2 = [[atom xa]]lst. s2a) "
     using check_s_elims(4)[OF *] Abs1_eq_iff_all(3) by metis
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , s1 \<rangle> \<Leftarrow> t"  using config_typeI ** by auto
   then obtain \<Delta>' where s1r: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s1' \<rangle> \<Leftarrow> t \<and> \<Delta> \<sqsubseteq> \<Delta>'" using reduce_let2I by presburger
 
   have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_let2 xa t s1' s2a  \<Leftarrow> \<tau>" 
   proof(rule check_let2I)
     show *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s1' \<Leftarrow> t" using config_type_elims st s1r by metis
     show  "atom xa \<sharp> (\<Theta>, \<Phi>, {||}::bv fset, GNil, \<Delta>',t, s1', \<tau>)" proof -  
       have "atom xa \<sharp> s1'" using  check_s_x_fresh *  by auto
       moreover have "atom xa \<sharp> \<Delta>'" using check_s_x_fresh * by auto
       ultimately show ?thesis  using st fresh_prodN by metis
     qed
 
     show "\<Theta> ; \<Phi> ; {||} ; (xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil ; \<Delta>'  \<turnstile> s2a \<Leftarrow> \<tau>"  proof -
       have "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using * check_s_wf by auto
       moreover have "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f ((xa, b_of t, c_of t xa) #\<^sub>\<Gamma> GNil)" using st check_s_wf by auto
       ultimately have "\<Theta> ; {||} ; ((xa, b_of t , c_of t xa) #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening by auto
       thus  ?thesis using check_s_d_weakening check_s_wf st  s1r by metis
     qed
   qed
   moreover have "AS_let2 xa t s1' s2a = AS_let2 x t s1' s2"  using st s_branch_s_branch_list.eq_iff by metis
   ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_let2 x t s1' s2  \<Leftarrow> \<tau>" using st by argo
   moreover have "\<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" using config_type_elims s1r by fast
   ultimately show ?case using config_typeI **
     by (meson s1r)
 next
   case (reduce_let2_valI vb \<delta> x t v s)
   then show ?case using preservation_let_val by meson
 next
   case (reduce_varI u \<delta> \<Phi> \<tau>' v s)
 
   hence ** : "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_var u \<tau>' v s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by meson
   have uf: "atom u \<sharp> \<Delta>" using reduce_varI delta_sim_fresh by force  
   hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_var u \<tau>' v s \<Leftarrow> \<tau>" and " \<Theta> \<turnstile> \<delta> \<sim> \<Delta>" using **  by auto
 
   thus ?case using preservation_var reduce_varI config_typeI ** set_subset_Cons
       setD_ConsD subsetI  by (metis delta_sim_fresh)
 
 next
   case (reduce_assignI \<Phi> \<delta> u v )
   hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_assign u v  \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by meson
   then obtain z and \<tau>' where zt: "\<Theta> ; {||} ; GNil \<turnstile> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<lesssim> \<tau> \<and> (u,\<tau>') \<in> setD \<Delta> \<and> \<Theta> ; {||} ; GNil \<turnstile> v \<Leftarrow> \<tau>' \<and> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>" 
     using check_s_elims(8) by metis
   hence "\<Theta> \<turnstile> update_d \<delta> u v \<sim> \<Delta>" using update_d_sim  * by metis
   moreover have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_val (V_lit L_unit ) \<Leftarrow> \<tau>" using zt * check_s_v_unit check_s_wf
     by auto
   ultimately show ?case using config_typeI * by (meson order_refl)
 next
   case (reduce_seq1I \<Phi> \<delta> s)
   hence "\<Theta> ; \<Phi> ;   {||} ; GNil ; \<Delta> \<turnstile> s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using check_s_elims config_type_elims by force
   then show ?case  using config_typeI by blast
 next
   case (reduce_seq2I s1 v \<Phi> \<delta> \<delta>' s1' s2)
   hence tt: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_seq s1 s2 \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by blast
   then obtain z where zz: "\<Theta> ; \<Phi> ; {||} ; GNil; \<Delta>  \<turnstile> s1 \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and>  \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> s2 \<Leftarrow> \<tau>" 
     using check_s_elims by blast
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle> \<delta> , s1 \<rangle> \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>)" 
     using tt config_typeI tt by simp 
   then obtain \<Delta>' where *: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s1' \<rangle> \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
     using reduce_seq2I by meson
   moreover hence  s't: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s1' \<Leftarrow> (\<lbrace> z : B_unit | TRUE \<rbrace>) \<and> \<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" 
     using config_type_elims by force
   moreover hence "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using check_s_wf by meson
   moreover hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> s2 \<Leftarrow> \<tau>" 
     using calculation(1) zz check_s_d_weakening * by metis
   moreover hence  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> (AS_seq s1' s2) \<Leftarrow> \<tau>" 
     using check_seqI zz s't by meson 
   ultimately have  "\<Theta>; \<Phi>; \<Delta>'  \<turnstile> \<langle> \<delta>' , AS_seq s1' s2 \<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'"
     using zz config_typeI tt  by meson
   then show ?case by meson
 next
   case (reduce_whileI x  s1 s2 z' \<Phi> \<delta> )
 
   hence *: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2  \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by meson
 
   hence  **:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_while s1 s2  \<Leftarrow> \<tau>" by auto
   hence "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_let2 x (\<lbrace> z' : B_bool  | TRUE \<rbrace>) s1 (AS_if (V_var x) (AS_seq s2 (AS_while s1 s2))  (AS_val (V_lit L_unit)) ) \<Leftarrow> \<tau>"
     using check_while reduce_whileI by auto
   thus ?case  using config_typeI *   by (meson subset_refl)
 
 next
   case (reduce_caseI dc x' s' css \<Phi> \<delta> tyid  v)
 
   hence **: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_match (V_cons tyid dc v) css \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)"
     using config_type_elims[OF reduce_caseI(2)] by metis
   hence ***: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AS_match (V_cons tyid  dc v) css \<Leftarrow> \<tau>" by auto
 
   let ?vcons = "V_cons tyid dc v"
 
   obtain dclist tid  and z::x where cv:  "\<Theta>; {||} ; GNil \<turnstile> (V_cons tyid dc v) \<Leftarrow> (\<lbrace> z : B_id tid | TRUE \<rbrace>) \<and> 
     \<Theta>; \<Phi>; {||}; GNil; \<Delta> ; tid ; dclist ; (V_cons tyid dc v) \<turnstile> css \<Leftarrow> \<tau> \<and>  AF_typedef tid dclist \<in> set \<Theta> \<and> 
  \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>"
     using check_s_elims(9)[OF ***] by metis
 
   hence vi:" \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Leftarrow> \<lbrace> z : B_id tid  | TRUE \<rbrace>" by auto
   obtain tcons where vi2:" \<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Rightarrow> tcons \<and> \<Theta> ; {||} ; GNil  \<turnstile> tcons \<lesssim>  \<lbrace> z : B_id tid  | TRUE \<rbrace>" 
     using check_v_elims(1)[OF vi] by metis
   hence vi1: "\<Theta> ; {||} ; GNil  \<turnstile> V_cons tyid dc v \<Rightarrow> tcons" by auto
 
   show ?case proof(rule infer_v_elims(4)[OF vi1],goal_cases)
     case (1 dclist2 tc tv z2)
     have "tyid = tid" using \<tau>.eq_iff using subtype_eq_base vi2 1 by fastforce 
     hence deq:"dclist = dclist2"  using check_v_wf wfX_wfY cv 1  wfTh_dclist_unique by metis
     have "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> s'[x'::=v]\<^sub>s\<^sub>v \<Leftarrow> \<tau>" proof(rule check_match(3))     
       show \<open> \<Theta> ;  \<Phi> ;  {||} ; GNil ; \<Delta> ; tyid ; dclist ; ?vcons \<turnstile> css \<Leftarrow> \<tau>\<close> using \<open>tyid = tid\<close> cv by auto
       show "distinct (map fst dclist)" using wfTh_dclist_distinct check_v_wf wfX_wfY cv by metis
       show \<open>?vcons = V_cons tyid dc v\<close> by auto
       show \<open>{||} = {||}\<close> by auto
       show \<open>(dc, tc) \<in> set dclist\<close> using 1 deq by auto
       show \<open>GNil = GNil\<close> by auto
       show \<open>Some (AS_branch dc x' s') = lookup_branch dc css\<close> using reduce_caseI by auto
       show \<open>\<Theta> ; {||} ; GNil  \<turnstile> v \<Leftarrow> tc\<close> using 1 check_v.intros by auto
     qed
     thus  ?case using config_typeI ** by blast
   qed
 
 next
   case (reduce_let_fstI \<Phi> \<delta> x v1 v2 s)
   thus ?case using preservation_fst_snd order_refl by metis
 next
   case (reduce_let_sndI  \<Phi> \<delta> x v1 v2 s)
   thus ?case using preservation_fst_snd order_refl by metis
 next
   case (reduce_let_concatI \<Phi> \<delta> x v1 v2 s)
   hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) s \<Leftarrow> \<tau> \<and> 
                   \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by metis
 
   obtain z::x where z: "atom z \<sharp> (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)), GNil, CE_val (V_lit (L_bitvec (v1 @ v2))))" 
     using obtain_fresh by metis
 
   have "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil" using check_s_wf elim by auto
 
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (AE_val (V_lit (L_bitvec (v1 @ v2)))) s \<Leftarrow> \<tau>" proof(rule subtype_let)
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let x (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) s \<Leftarrow> \<tau>\<close> using elim by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> (AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) \<Rightarrow> \<lbrace> z : B_bitvec  | CE_val (V_var z)  == (CE_concat ([V_lit (L_bitvec v1)]\<^sup>c\<^sup>e) ([V_lit (L_bitvec v2)]\<^sup>c\<^sup>e))\<rbrace> \<close> 
       (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e1 \<Rightarrow> ?t1")
     proof
       show \<open> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_s_wf elim by auto
       show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_s_wf elim by auto
       show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v1) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v1)) \<rbrace>\<close> 
         using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
       show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v2) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v2)) \<rbrace>\<close> 
         using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
       show \<open>atom z \<sharp> AE_concat (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))\<close> using z fresh_Pair by metis
       show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
     qed
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val (V_lit (L_bitvec (v1 @ v2))) \<Rightarrow>  \<lbrace> z : B_bitvec  | CE_val (V_var z) == CE_val (V_lit (L_bitvec (v1 @ v2))) \<rbrace> \<close> 
       (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e2 \<Rightarrow> ?t2")
       using infer_e_valI infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil check_s_wf elim by metis
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> ?t2 \<lesssim> ?t1\<close> using subtype_concat check_s_wf elim by auto
   qed
 
   thus ?case  using config_typeI elim by (meson order_refl)
 next
   case (reduce_let_lenI \<Phi> \<delta> x v s)
   hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_len (V_lit (L_bitvec v))) s \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using check_s_elims config_type_elims by metis
 
   then obtain t where t: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile> AE_len (V_lit (L_bitvec v)) \<Rightarrow> t"   using check_s_elims by meson
 
   moreover then obtain z::x where  "t = \<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len ([V_lit (L_bitvec v)]\<^sup>c\<^sup>e)  \<rbrace>" using infer_e_elims by meson 
 
   moreover obtain z'::x where "atom z' \<sharp> v" using obtain_fresh by metis
   moreover have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile>  AE_val (V_lit (L_num (int (length v)))) \<Rightarrow> \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v))))  \<rbrace>" 
     using infer_e_valI infer_v_litI infer_l.intros(3)  t  check_s_wf elim 
     by (metis infer_l_form2 type_for_lit.simps(3))
 
   moreover have "\<Theta> ; {||} ; GNil \<turnstile>   \<lbrace> z' : B_int  | CE_val (V_var z')  ==  CE_val (V_lit (L_num (int (length v))))  \<rbrace> \<lesssim> 
                            \<lbrace> z : B_int  | CE_val (V_var z)  ==  CE_len [(V_lit (L_bitvec v))]\<^sup>c\<^sup>e  \<rbrace>" using subtype_len check_s_wf elim by auto
 
   ultimately have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile>  AS_let x (AE_val (V_lit (L_num (int (length v)))))  s \<Leftarrow> \<tau>" using subtype_let by (meson elim)
   thus ?case  using config_typeI elim by (meson order_refl)
 next
   case (reduce_let_splitI n v v1 v2 \<Phi> \<delta> x s)
   hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_let x (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) s \<Leftarrow> \<tau> \<and> 
                   \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by metis
 
   obtain z::x where z: "atom z \<sharp> (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n)), GNil, CE_val (V_lit (L_bitvec (v1 @ v2))), 
 ([ L_bitvec v1 ]\<^sup>v, [ L_bitvec v2 ]\<^sup>v), \<Theta>, {||}::bv fset)" 
     using obtain_fresh by metis
 
   have *:"\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil" using check_s_wf elim by auto
 
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> AS_let x (AE_val (V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)))) s \<Leftarrow> \<tau>" proof(rule subtype_let)
 
     show \<open> \<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AS_let x (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) s \<Leftarrow> \<tau>\<close> using elim by auto
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> (AE_split (V_lit (L_bitvec v)) (V_lit (L_num n))) \<Rightarrow> \<lbrace> z : B_pair B_bitvec B_bitvec  
                  |   ((CE_val (V_lit (L_bitvec v))) == (CE_concat (CE_fst (CE_val (V_var z))) (CE_snd (CE_val (V_var z)))))
                   AND (((CE_len (CE_fst (CE_val (V_var z))))) == (CE_val (V_lit (L_num n)))) \<rbrace> \<close> 
       (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e1 \<Rightarrow> ?t1") 
     proof
       show \<open> \<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using check_s_wf elim by auto
       show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using check_s_wf elim by auto
       show \<open> \<Theta> ; {||} ; GNil  \<turnstile> V_lit (L_bitvec v) \<Rightarrow> \<lbrace> z : B_bitvec | CE_val (V_var z) == CE_val (V_lit (L_bitvec v)) \<rbrace>\<close> 
         using infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close>  fresh_GNil by auto
       show "\<Theta> ; {||} ; GNil  \<turnstile> ([ L_num
                            n ]\<^sup>v) \<Leftarrow> \<lbrace> z : B_int  | (([ leq [ [ L_num 0 ]\<^sup>v ]\<^sup>c\<^sup>e [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e)  ==  ([ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e))   AND  [ leq [ [ z ]\<^sup>v ]\<^sup>c\<^sup>e [| [ [ L_bitvec
                    v ]\<^sup>v ]\<^sup>c\<^sup>e |]\<^sup>c\<^sup>e ]\<^sup>c\<^sup>e  ==  [ [ L_true ]\<^sup>v ]\<^sup>c\<^sup>e   \<rbrace>" using split_n  reduce_let_splitI check_v_num_leq * wfX_wfY  by metis
       show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
       show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
       show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
       show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
       show \<open>atom z \<sharp> AE_split [ L_bitvec v ]\<^sup>v [ L_num n ]\<^sup>v\<close> using z fresh_Pair by auto
       show \<open>atom z \<sharp> GNil\<close> using z fresh_Pair by auto
     qed
 
     show \<open>\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> AE_val (V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2))) \<Rightarrow>  \<lbrace> z : B_pair B_bitvec  B_bitvec  | CE_val (V_var z) == CE_val ((V_pair (V_lit (L_bitvec v1)) (V_lit (L_bitvec v2)))) \<rbrace> \<close> 
       (is "\<Theta>; \<Phi>; {||}; GNil; \<Delta>   \<turnstile> ?e2 \<Rightarrow> ?t2")
       apply(rule infer_e_valI)
       using check_s_wf elim apply metis
       using check_s_wf elim apply metis      
       apply(rule infer_v_pair2I)
       using z fresh_prodN apply metis
       using z fresh_GNil fresh_prodN apply metis
       using  infer_v_litI infer_l.intros  \<open>\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f GNil\<close> b_of.simps  apply blast+
       using b_of.simps apply simp+
       done
     show \<open>\<Theta> ; {||} ; GNil  \<turnstile> ?t2 \<lesssim> ?t1\<close> using subtype_split check_s_wf elim reduce_let_splitI by auto
   qed
 
   thus ?case  using config_typeI elim by (meson order_refl)
 next
   case (reduce_assert1I \<Phi> \<delta> c v)
 
   hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c [v]\<^sup>s   \<Leftarrow> \<tau> \<and> 
                   \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims reduce_assert1I by metis
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c [v]\<^sup>s   \<Leftarrow> \<tau>" by auto
 
   have  "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  [v]\<^sup>s   \<Leftarrow> \<tau>" using  check_assert_s *  by metis
   thus  ?case using elim config_typeI  by blast
 next
   case (reduce_assert2I \<Phi> \<delta> s \<delta>' s' c)
 
   hence elim: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s  \<Leftarrow> \<tau> \<and> 
                   \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<and> (\<forall>fd\<in>set \<Phi>. check_fundef \<Theta> \<Phi> fd)" 
     using config_type_elims by metis
   hence *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  AS_assert c s   \<Leftarrow> \<tau>" by auto
 
   have  cv: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>  \<turnstile>  s   \<Leftarrow> \<tau> \<and> \<Theta> ; {||} ; GNil  \<Turnstile> c " using check_assert_s *  by metis
 
   hence "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>" using elim config_typeI by simp
   then obtain \<Delta>' where D: "\<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s' \<rangle> \<Leftarrow> \<tau>  \<and> \<Delta> \<sqsubseteq> \<Delta>'" using reduce_assert2I by metis
   hence **:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>' \<turnstile> s' \<Leftarrow> \<tau> \<and> \<Theta> \<turnstile> \<delta>' \<sim> \<Delta>'" using config_type_elims by metis
 
   obtain x::x where x:"atom x \<sharp> (\<Theta>, \<Phi>, ({||}::bv fset), GNil, \<Delta>', c, \<tau>, s')" using obtain_fresh by metis
 
   have *:"\<Theta>; \<Phi>; {||}; GNil; \<Delta>'  \<turnstile> AS_assert c s'  \<Leftarrow> \<tau>" proof
     show "atom x \<sharp> (\<Theta>, \<Phi>, {||}, GNil, \<Delta>', c, \<tau>, s')" using x by auto
     have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f c" using * check_s_wf by auto
     hence wfg:"\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> GNil" using wfC_wfG wfB_boolI check_s_wf *  fresh_GNil by auto
     moreover have cs: "\<Theta>; \<Phi>; {||}; GNil; \<Delta>' \<turnstile> s' \<Leftarrow> \<tau>" using ** by auto
     ultimately show  "\<Theta> ; \<Phi> ; {||} ; (x, B_bool, c) #\<^sub>\<Gamma> GNil ; \<Delta>'  \<turnstile> s' \<Leftarrow> \<tau>" using check_s_g_weakening(1)[OF cs _ wfg]   toSet.simps  by simp
     show "\<Theta> ; {||} ; GNil  \<Turnstile> c " using cv by auto
     show "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<Delta>' " using check_s_wf ** by auto
   qed
 
   thus  ?case using elim config_typeI D ** by metis
 qed
 
 lemma preservation_many: 
   assumes " \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow>\<^sup>* \<langle> \<delta>' , s' \<rangle>"
   shows "\<Theta>; \<Phi>; \<Delta> \<turnstile>  \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau> \<Longrightarrow> \<exists>\<Delta>'. \<Theta>; \<Phi>; \<Delta>' \<turnstile> \<langle> \<delta>' , s' \<rangle> \<Leftarrow> \<tau> \<and> \<Delta> \<sqsubseteq> \<Delta>'" 
   using assms proof(induct arbitrary: \<Delta> rule: reduce_stmt_many.induct)
   case (reduce_stmt_many_oneI \<Phi> \<delta> s \<delta>' s')
   then show ?case using preservation by simp
 next
   case (reduce_stmt_many_manyI \<Phi> \<delta> s \<delta>' s' \<delta>'' s'')
   then show ?case using preservation subset_trans by metis
 qed
 
 section \<open>Progress\<close>
 text \<open>We prove that a well typed program is either a value or we can make a step\<close>
 
 lemma check_let_op_infer:
   assumes  "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>   \<turnstile> LET x = (AE_op opp v1 v2) IN s \<Leftarrow> \<tau>" and "supp ( LET x = (AE_op opp v1 v2) IN s) \<subseteq> atom`fst`setD \<Delta>"
   shows  "\<exists> z b c. \<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile>  (AE_op opp v1 v2) \<Rightarrow> \<lbrace>z:b|c\<rbrace>"
 proof - 
   have xx: "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile> LET x = (AE_op opp v1 v2) IN s \<Leftarrow> \<tau>" using assms by simp
   then show ?thesis using check_s_elims(2)[OF xx] by meson
 qed
 
 lemma infer_pair:
   assumes "\<Theta> ; B; \<Gamma> \<turnstile>  v  \<Rightarrow> \<lbrace> z : B_pair b1 b2  | c \<rbrace>" and "supp v = {}"
   obtains v1 and v2 where "v = V_pair v1 v2" 
   using assms proof(nominal_induct v rule: v.strong_induct)
   case (V_lit x)
   then show ?case by auto
 next
   case (V_var x)
   then show ?case using v.supp supp_at_base by auto
 next
   case (V_pair x1a x2a)
   then show ?case by auto
 next
   case (V_cons x1a x2a x3)
   then show ?case by auto
 next
   case (V_consp x1a x2a x3 x4)
   then show ?case by auto
 qed
 
 lemma progress_fst:
   assumes  "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>  \<turnstile> LET x = (AE_fst v) IN s \<Leftarrow> \<tau>" and  "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and 
     "supp (LET x = (AE_fst v) IN s)  \<subseteq> atom`fst`setD \<Delta>"
   shows "\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle> \<delta> , LET x = (AE_fst v) IN s \<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>"
 proof -
   have *:"supp v = {}" using assms s_branch_s_branch_list.supp by auto
   obtain z and b and c where "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile>  (AE_fst v ) \<Rightarrow> \<lbrace> z : b  | c \<rbrace>" 
     using check_s_elims(2)  using assms by meson
   moreover obtain z' and b' and c' where "\<Theta> ; {||} ; \<Gamma> \<turnstile>  v  \<Rightarrow> \<lbrace> z' : B_pair b b'  | c' \<rbrace>" 
     using infer_e_elims(8)  using calculation by auto 
   moreover then obtain v1 and v2 where "V_pair v1 v2 = v" 
     using * infer_pair by metis
   ultimately show ?thesis using reduce_let_fstI assms  by metis
 qed
 
 lemma progress_let:
   assumes "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta> \<turnstile> LET x = e IN s \<Leftarrow> \<tau>" and "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>" and 
     "supp (LET x = e IN s) \<subseteq> atom ` fst ` setD \<Delta>" and "sble \<Theta> \<Gamma>"
   shows "\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle> \<delta> , LET x = e IN s\<rangle> \<longrightarrow> \<langle> \<delta>' , s'\<rangle>"
 proof -
   obtain z b c where *: "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>  \<turnstile> e \<Rightarrow> \<lbrace> z : b  | c \<rbrace> " using check_s_elims(2)[OF assms(1)] by metis
   have **: "supp e \<subseteq> atom ` fst ` setD \<Delta>" using assms s_branch_s_branch_list.supp by auto
   from * ** assms show ?thesis proof(nominal_induct "\<lbrace> z : b  | c \<rbrace>"  rule: infer_e.strong_induct)
     case (infer_e_valI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v)
     then show ?case using reduce_stmt_elims reduce_let_valI by metis
   next
     case (infer_e_plusI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
     hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
     then obtain n1 and n2 where *: "v1 = V_lit (L_num n1)  \<and> v2 = (V_lit (L_num n2))" using infer_int infer_e_plusI by metis
     then show ?case using reduce_let_plusI * by metis
   next
     case (infer_e_leqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
     hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
     then obtain n1 and n2 where *: "v1 = V_lit (L_num n1)  \<and> v2 = (V_lit (L_num n2))" using infer_int infer_e_leqI by metis
     then show ?case using reduce_let_leqI * by metis
   next
     case (infer_e_eqI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 bb c1 v2 z2 c2 z3)
     hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
     then obtain n1 and n2 where *: "v1 = V_lit n1  \<and> v2 = (V_lit n2)" using infer_lit infer_e_eqI by metis
     then show ?case using reduce_let_eqI by blast
   next
     case (infer_e_appI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> f x b c \<tau>' s' v)
     then show ?case using reduce_let_appI by metis
   next
     case (infer_e_appPI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> b' f bv x b c \<tau>' s' v)
     then show ?case using reduce_let_appPI by metis
   next
     case (infer_e_fstI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b2 c z)
     hence "supp v = {}" by force
     then obtain v1 and v2 where "v = V_pair v1 v2" using infer_e_fstI infer_pair by metis
     then show ?case using reduce_let_fstI * by metis
   next
     case (infer_e_sndI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' b1 c z)
     hence "supp v = {}" by force
     then obtain v1 and v2 where "v = V_pair v1 v2" using infer_e_sndI infer_pair by metis
     then show ?case using reduce_let_sndI * by metis
   next
     case (infer_e_lenI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v z' c za)
     hence "supp v = {}" by force
     then obtain bvec where "v = V_lit (L_bitvec bvec)" using infer_e_lenI infer_bitvec by metis
     then show ?case using reduce_let_lenI * by metis
   next
     case (infer_e_mvarI \<Theta> \<B> \<Gamma> \<Phi> \<Delta> u)
     hence "(u, \<lbrace> z : b  | c \<rbrace>) \<in> setD \<Delta>" using infer_e_elims(10) by meson
     then obtain v where "(u,v) \<in> set \<delta>" using infer_e_mvarI delta_sim_delta_lookup by meson
     then show ?case using reduce_let_mvar by metis
   next
     case (infer_e_concatI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 c2 z3)
     hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
     then obtain n1 and n2 where *: "v1 = V_lit (L_bitvec n1)  \<and> v2 = (V_lit (L_bitvec n2))" using infer_bitvec infer_e_concatI by metis
     then show ?case using reduce_let_concatI * by metis
   next
     case (infer_e_splitI \<Theta> \<B> \<Gamma> \<Delta> \<Phi> v1 z1 c1 v2 z2 z3)
     hence vf: "supp v1 = {} \<and> supp v2 = {}"  by force
     then obtain n1 and n2 where *: "v1 = V_lit (L_bitvec n1)  \<and> v2 = (V_lit (L_num n2))" using infer_bitvec infer_e_splitI check_int by metis
 
     have "0 \<le> n2 \<and> n2 \<le> int (length n1)" using  check_v_range[OF _ * ]   infer_e_splitI by simp
     then obtain bv1 and bv2 where "split n2 n1 (bv1 , bv2)" using obtain_split by metis
     then show ?case using reduce_let_splitI * by metis
   qed
 qed 
 
 lemma check_css_lookup_branch_exist:
   fixes s::s and cs::branch_s and css::branch_list and v::v
   shows 
     "\<Theta>; \<Phi>; B; G; \<Delta> \<turnstile>  s \<Leftarrow> \<tau> \<Longrightarrow> True" and 
     "check_branch_s \<Theta> \<Phi>  {||} GNil \<Delta> tid dc const v cs \<tau> \<Longrightarrow> True" and 
     "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; dclist; v \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> (dc, t) \<in> set dclist \<Longrightarrow>  
               \<exists>x' s'. Some (AS_branch dc x' s') = lookup_branch dc css"
 proof(nominal_induct \<tau> and \<tau> and \<tau>  rule: check_s_check_branch_s_check_branch_list.strong_induct)
   case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau> dclist css)
   then show ?case  using lookup_branch.simps check_branch_list_finalI by force
 next
   case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid cons const v cs \<tau>)
   then show ?case  using lookup_branch.simps check_branch_list_finalI by force
 qed(auto+)
 
 lemma progress_aux:  
   shows    "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile> s \<Leftarrow> \<tau> \<Longrightarrow> \<B> = {||} \<Longrightarrow>  sble \<Theta> \<Gamma> \<Longrightarrow> supp s \<subseteq> atom ` fst ` setD \<Delta> \<Longrightarrow> \<Theta> \<turnstile> \<delta> \<sim> \<Delta> \<Longrightarrow> 
                (\<exists>v. s = [v]\<^sup>s) \<or> (\<exists>\<delta>' s'. \<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>)" and
     "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>; tid; dc; const; v2 \<turnstile> cs \<Leftarrow> \<tau>  \<Longrightarrow> supp cs = {} \<Longrightarrow> True " 
     "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>; tid; dclist; v2 \<turnstile> css \<Leftarrow> \<tau> \<Longrightarrow> supp css = {} \<Longrightarrow> True " 
 proof(induct  rule: check_s_check_branch_s_check_branch_list.inducts)
   case (check_valI \<Delta> \<Theta> \<Gamma> v \<tau>' \<tau>)
   then show ?case by auto
 next
   case (check_letI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e \<tau> z s b c)
   hence "\<Theta>; \<Phi>; {||}; \<Gamma>; \<Delta>   \<turnstile>   AS_let x e s \<Leftarrow> \<tau>" using Typing.check_letI by meson
   then show ?case using progress_let check_letI by metis
 next
   case (check_branch_s_branchI \<Theta> \<B> \<Gamma> \<Delta> \<tau> const x \<Phi> tid cons v s)
   then show ?case by auto
 next
   case (check_branch_list_consI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau> css)
   then show ?case by auto
 next
   case (check_branch_list_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>)
   then show ?case by auto
 next
   case (check_ifI z \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v s1 s2 \<tau>)
   have "supp v = {}" using check_ifI s_branch_s_branch_list.supp by auto
   hence "v = V_lit L_true \<or> v = V_lit L_false" using  check_bool_options check_ifI by auto
   then show ?case using reduce_if_falseI reduce_if_trueI check_ifI by meson
 next
   case (check_let2I x \<Theta> \<Phi> \<B> G \<Delta> t s1 \<tau> s2 )
   then consider  " (\<exists>v. s1 = AS_val v)" | "(\<exists>\<delta>' a. \<Phi>  \<turnstile> \<langle>\<delta>, s1\<rangle> \<longrightarrow> \<langle>\<delta>', a\<rangle>)" by auto
   then show ?case proof(cases)
     case 1
     then show ?thesis using reduce_let2_valI by fast
   next
     case 2
     then show ?thesis using reduce_let2I check_let2I by meson
   qed
 next
   case (check_varI u \<Theta> \<Phi> \<B> \<Gamma> \<Delta> \<tau>' v \<tau> s)
 
   obtain uu::u where uf: "atom uu \<sharp> (u,\<delta>,s) " using obtain_fresh by blast
   obtain sa where " (uu \<leftrightarrow> u ) \<bullet> s = sa" by presburger
   moreover have "atom uu \<sharp> s" using uf fresh_prod3 by auto
   ultimately have "AS_var uu \<tau>' v sa = AS_var u \<tau>' v s" using s_branch_s_branch_list.eq_iff(7) Abs1_eq_iff(3)[of uu sa u s] by auto
 
   moreover have "atom uu \<sharp> \<delta>" using uf fresh_prod3 by auto
   ultimately have "\<Phi> \<turnstile> \<langle>\<delta>, AS_var u \<tau>' v s\<rangle> \<longrightarrow> \<langle>(uu, v) # \<delta>, sa\<rangle>"
     using reduce_varI uf by metis
   then show ?case by auto
 next
   case (check_assignI \<Delta> u \<tau> P G v z \<tau>')
   then show ?case using reduce_assignI by blast
 next
   case (check_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 z s2 \<tau>')
   obtain x::x where "atom x \<sharp> (s1,s2)" using obtain_fresh by metis
   moreover obtain z::x where "atom z \<sharp> x" using obtain_fresh by metis
   ultimately show ?case using reduce_whileI by fast
 next
   case (check_seqI P \<Phi> \<B> G \<Delta> s1 z s2 \<tau>)
   thus  ?case proof(cases "\<exists>v. s1 = AS_val v")
     case True
     then obtain v where v: "s1 = AS_val v" by blast
     hence "supp v = {}" using check_seqI by auto
     have "\<exists>z1 c1. P; \<B>; G \<turnstile> v \<Rightarrow> (\<lbrace> z1 : B_unit | c1 \<rbrace>)" proof - 
       obtain t where t:"P; \<B>; G \<turnstile> v \<Rightarrow> t \<and> P; \<B> ; G \<turnstile> t \<lesssim> (\<lbrace> z : B_unit | TRUE \<rbrace>)"  
         using v check_seqI(1) check_s_elims(1) by blast
       obtain z1 and b1 and c1 where teq: "t =  (\<lbrace> z1 : b1 | c1 \<rbrace>)" using obtain_fresh_z by meson
       hence "b1 = B_unit" using subtype_eq_base t by meson
       thus ?thesis using t teq by fast
     qed
     then obtain z1 and c1 where "P ; \<B> ; G \<turnstile> v \<Rightarrow> (\<lbrace> z1 : B_unit | c1 \<rbrace>)" by auto
     hence "v = V_lit L_unit" using infer_v_unit_form \<open>supp v = {}\<close> by simp
     hence "s1 = AS_val (V_lit L_unit)" using v by auto
     then show ?thesis using check_seqI reduce_seq1I by meson
   next
     case False
     then show ?thesis using check_seqI reduce_seq2I 
       by (metis Un_subset_iff s_branch_s_branch_list.supp(9))
   qed
 
 next
   case (check_caseI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist v cs \<tau>  z)
   hence "supp v = {}" by auto
 
   then obtain v' and dc and t::\<tau> where v: "v = V_cons tid dc v' \<and> (dc, t) \<in> set dclist" 
     using  check_v_tid_form check_caseI by metis
   obtain z and b and c where teq: "t = (\<lbrace> z : b | c \<rbrace>)" using obtain_fresh_z by meson
 
   moreover then obtain x' s' where  "Some (AS_branch dc x' s') = lookup_branch dc cs" using  v teq check_caseI check_css_lookup_branch_exist by metis
   ultimately show ?case using reduce_caseI v check_caseI dc_of.cases by metis
 next
   case (check_assertI x \<Theta> \<Phi> \<B> \<Gamma> \<Delta> c \<tau> s)
   hence sps: "supp s \<subseteq> atom ` fst ` setD \<Delta>" by auto
   have "atom x \<sharp> c " using check_assertI by auto
   have "atom x \<sharp> \<Gamma>" using check_assertI check_s_wf wfG_elims by metis
   have "sble \<Theta> ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>)" proof -
     obtain i' where i':" i' \<Turnstile> \<Gamma>  \<and>  \<Theta>; \<Gamma> \<turnstile> i'" using check_assertI sble_def by metis
     obtain i::valuation where i:"i = i' ( x \<mapsto> SBool True)" by auto
 
     have "i \<Turnstile> (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>" proof -
       have "i' \<Turnstile> c" using valid.simps i'  check_assertI by metis
       hence "i \<Turnstile> c" using is_satis_weakening_x i \<open>atom x \<sharp> c\<close> by auto
       moreover have "i \<Turnstile> \<Gamma>"  using is_satis_g_weakening_x i' i  check_assertI \<open>atom x \<sharp> \<Gamma>\<close> by metis
       ultimately show ?thesis   using is_satis_g.simps i by auto
     qed
     moreover have "\<Theta> ; ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<turnstile> i" proof(rule  wfI_cons)
       show \<open> i' \<Turnstile> \<Gamma> \<close> using i' by auto
       show \<open> \<Theta> ; \<Gamma> \<turnstile> i'\<close> using i' by auto
       show \<open>i = i'(x \<mapsto> SBool True)\<close> using i by auto
       show \<open> \<Theta>  \<turnstile> SBool True: B_bool\<close> using wfRCV_BBoolI by auto
       show \<open>atom x \<sharp> \<Gamma>\<close> using check_assertI check_s_wf wfG_elims by auto
     qed
     ultimately show  ?thesis using sble_def by auto
   qed
   then consider "(\<exists>v. s = [v]\<^sup>s)" | "(\<exists>\<delta>' a.  \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle> \<delta>', a\<rangle>)" using check_assertI sps by metis
   hence "(\<exists>\<delta>' a.  \<Phi>  \<turnstile> \<langle>\<delta>, ASSERT c IN s\<rangle> \<longrightarrow> \<langle>\<delta>', a\<rangle>)" proof(cases)
     case 1
     then show ?thesis using reduce_assert1I by metis
   next
     case 2
     then show ?thesis using reduce_assert2I by metis
   qed  
   thus ?case by auto
 qed
 
 lemma progress:
   assumes "\<Theta>; \<Phi>; \<Delta> \<turnstile> \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>" 
   shows "(\<exists>v. s = [v]\<^sup>s) \<or> (\<exists>\<delta>' s'. \<Phi>  \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow> \<langle>\<delta>', s'\<rangle>)"
 proof -
   have "\<Theta>; \<Phi>; {||}; GNil; \<Delta> \<turnstile> s \<Leftarrow> \<tau>" and "\<Theta> \<turnstile> \<delta> \<sim> \<Delta>"
     using config_type_elims[OF assms(1)] by auto+
   moreover hence "supp s \<subseteq> atom ` fst ` setD \<Delta>" using check_s_wf wfS_supp by fastforce
   moreover have "sble \<Theta> GNil" using sble_def wfI_def is_satis_g.simps by simp
   ultimately show  ?thesis using progress_aux by blast
 qed
 
 section \<open>Safety\<close>
 
 lemma  safety_stmt:
   assumes "\<Phi> \<turnstile> \<langle>\<delta>, s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>', s'\<rangle>" and "\<Theta>; \<Phi>; \<Delta> \<turnstile>  \<langle>\<delta>, s\<rangle> \<Leftarrow> \<tau>"
   shows  "(\<exists>v. s' = [v]\<^sup>s) \<or> (\<exists>\<delta>'' s''. \<Phi>  \<turnstile> \<langle>\<delta>', s'\<rangle> \<longrightarrow> \<langle>\<delta>'', s''\<rangle>)"  
   using preservation_many progress assms  by meson
 
 lemma safety:
   assumes "\<turnstile> \<langle>PROG \<Theta> \<Phi> \<G> s\<rangle> \<Leftarrow> \<tau>" and  "\<Phi>  \<turnstile> \<langle>\<delta>_of \<G>, s\<rangle> \<longrightarrow>\<^sup>* \<langle>\<delta>', s'\<rangle>"
   shows  "(\<exists>v. s' = [v]\<^sup>s) \<or> (\<exists>\<delta>'' s''. \<Phi>  \<turnstile> \<langle>\<delta>', s'\<rangle> \<longrightarrow> \<langle>\<delta>'', s''\<rangle>)"   
   using assms config_type_prog_elims safety_stmt by metis
 
 end
\ No newline at end of file
diff --git a/thys/MiniSail/Syntax.thy b/thys/MiniSail/Syntax.thy
--- a/thys/MiniSail/Syntax.thy
+++ b/thys/MiniSail/Syntax.thy
@@ -1,1174 +1,1174 @@
 (*<*)
 theory Syntax
   imports "Nominal2.Nominal2" "Nominal-Utils"
 begin
   (*>*)
 
 chapter \<open>Syntax\<close>
 
 text \<open>Syntax of MiniSail programs and the contexts we use in judgements.\<close>
 
 section \<open>Program Syntax\<close>
 
 subsection \<open>AST Datatypes\<close>
 
 type_synonym num_nat = nat
 
 atom_decl x  (* Immutable variables*)
 atom_decl u  (* Mutable variables *)
 atom_decl bv  (* Basic-type variables *)
 
 type_synonym f = string  (* Function name *)
 type_synonym dc = string (* Data constructor *)
 type_synonym tyid = string
 
 text \<open>Basic types. Types without refinement constraints\<close>
 nominal_datatype "b" =  
   B_int | B_bool | B_id tyid 
 | B_pair b b  ("[ _ , _ ]\<^sup>b")
 | B_unit | B_bitvec | B_var bv
 | B_app tyid b
 
 nominal_datatype bit = BitOne | BitZero
 
 text  \<open> Literals \<close>
 nominal_datatype "l" = 
   L_num "int" | L_true | L_false | L_unit  | L_bitvec "bit list"
 
 text  \<open> Values. We include a type identifier, tyid, in the literal for constructors 
 to make typing and well-formedness checking easier \<close>
 
 nominal_datatype "v" = 
   V_lit "l"        ( "[ _ ]\<^sup>v")
   | V_var "x"        ( "[ _ ]\<^sup>v")
   | V_pair "v" "v"   ( "[ _ , _ ]\<^sup>v")
   | V_cons tyid dc "v" 
   | V_consp tyid dc b "v" 
 
 text \<open> Binary Operations \<close>
 nominal_datatype "opp" = Plus ( "plus") | LEq ("leq") | Eq ("eq")
 
 text \<open> Expressions \<close>
 nominal_datatype "e" = 
   AE_val "v"           ( "[ _ ]\<^sup>e"       )
   | AE_app "f" "v"       ( "[ _ ( _ ) ]\<^sup>e" )
   | AE_appP  "f" "b" "v" ( "[_ [ _ ] ( _ )]\<^sup>e" )
   | AE_op "opp" "v" "v"  ( "[ _ _ _ ]\<^sup>e"  )
   | AE_concat v v        ( "[ _ @@ _ ]\<^sup>e" )
   | AE_fst "v"           ( "[#1_ ]\<^sup>e"    )
   | AE_snd "v"           ( "[#2_ ]\<^sup>e"     )
   | AE_mvar "u"          ( "[ _ ]\<^sup>e"      )
   | AE_len "v"           ( "[| _ |]\<^sup>e"    )
   | AE_split "v" "v"     ( "[ _ / _ ]\<^sup>e"  )
 
 text \<open> Expressions for constraints\<close>
 nominal_datatype "ce" = 
   CE_val "v"           ( "[ _ ]\<^sup>c\<^sup>e"      )
   | CE_op "opp" "ce" "ce"  ( "[ _ _ _ ]\<^sup>c\<^sup>e"  )
   | CE_concat ce ce        ( "[ _ @@ _ ]\<^sup>c\<^sup>e" )
   | CE_fst "ce"           ( "[#1_]\<^sup>c\<^sup>e"      )
   | CE_snd "ce"           ( "[#2_]\<^sup>c\<^sup>e"      )
   | CE_len "ce"           ( "[| _ |]\<^sup>c\<^sup>e"    )
 
 text  \<open> Constraints \<close>
 nominal_datatype "c" = 
   C_true          ( "TRUE" [] 50 )
   | C_false         ( "FALSE" [] 50 )
   | C_conj "c" "c"  ("_  AND  _ " [50, 50] 50) 
   | C_disj "c" "c"  ("_ OR _ " [50,50] 50)
   | C_not "c"       ( "\<not> _ " [] 50 )
   | C_imp "c" "c"   ("_  IMP  _ " [50, 50] 50) 
   | C_eq "ce" "ce"  ("_  ==  _ " [50, 50] 50) 
 
 text  \<open> Refined types \<close>
 nominal_datatype "\<tau>" = 
   T_refined_type  x::x b c::c   binds x in c   ("\<lbrace> _ : _  | _ \<rbrace>" [50, 50] 1000)
 
 text \<open> Statements \<close>
 
 nominal_datatype 
   s = 
   AS_val v                             ( "[_]\<^sup>s")                  
   | AS_let x::x  e s::s binds x in s     ( "(LET _ = _ IN _)")
   | AS_let2 x::x \<tau>  s s::s binds x in s  ( "(LET _ : _ = _ IN _)")
   | AS_if v s s                          ( "(IF _ THEN _ ELSE _)" [0, 61, 0] 61)
   | AS_var u::u \<tau> v s::s  binds u in s   ( "(VAR _ : _ = _ IN _)")
   | AS_assign u  v                       ( "(_ ::= _)")
   | AS_match v branch_list               ( "(MATCH _ WITH { _ })")
   | AS_while s s                         ( "(WHILE _ DO { _ } )" [0, 0] 61)     
   | AS_seq s s                           ( "( _ ;; _ )"  [1000, 61] 61)
   | AS_assert c s                        ( "(ASSERT _ IN _ )" )
     and branch_s = 
     AS_branch dc x::x s::s binds x in s  ( "( _ _ \<Rightarrow> _ )")   
     and branch_list = 
     AS_final  branch_s                   ( "{ _ }" )
   | AS_cons  branch_s branch_list        ( "( _ | _  )")
 
 text \<open> Function and union type definitions \<close>
 
 nominal_datatype "fun_typ"  =
   AF_fun_typ x::x "b" c::c \<tau>::\<tau> s::s binds x in c \<tau> s
 
 nominal_datatype "fun_typ_q" = 
   AF_fun_typ_some bv::bv ft::fun_typ binds bv in ft
   | AF_fun_typ_none fun_typ
 
 nominal_datatype "fun_def" =  AF_fundef f fun_typ_q 
 
 nominal_datatype "type_def" = 
   AF_typedef string "(string * \<tau>) list"
   |  AF_typedef_poly string bv::bv dclist::"(string * \<tau>) list"  binds bv in dclist
 
 lemma check_typedef_poly:
   "AF_typedef_poly ''option'' bv [ (''None'', \<lbrace> zz : B_unit | TRUE \<rbrace>), (''Some'', \<lbrace> zz : B_var bv | TRUE \<rbrace>) ] = 
     AF_typedef_poly ''option'' bv2 [ (''None'', \<lbrace> zz : B_unit | TRUE \<rbrace>), (''Some'', \<lbrace> zz : B_var bv2 | TRUE \<rbrace>) ]"
   by auto
 
 nominal_datatype "var_def" =  AV_def u \<tau> v
 
 text  \<open> Programs \<close> 
 nominal_datatype "p" = 
   AP_prog "type_def list" "fun_def list" "var_def list" "s" ("PROG _ _ _ _")
 
 declare l.supp [simp] v.supp [simp]  e.supp [simp] s_branch_s_branch_list.supp [simp]  \<tau>.supp [simp] c.supp [simp] b.supp[simp]
 
 subsection \<open>Lemmas\<close>
 
 text \<open>These lemmas deal primarily with freshness and alpha-equivalence\<close>
 
 subsubsection \<open>Atoms\<close>
 
 lemma x_not_in_u_atoms[simp]:
   fixes u::u and x::x and us::"u set"
   shows "atom x \<notin> atom`us"
   by (simp add: image_iff)
 
 lemma x_fresh_u[simp]:
   fixes u::u and x::x
   shows "atom x \<sharp> u"
   by auto
 
 lemma x_not_in_b_set[simp]:
   fixes  x::x and bs::"bv fset"
   shows "atom x \<notin> supp bs"
   by(induct bs,auto, simp add: supp_finsert supp_at_base)
 
 lemma x_fresh_b[simp]:
   fixes  x::x and b::b
   shows "atom x \<sharp> b"
   apply (induct b rule: b.induct, auto simp: pure_supp)
   using pure_supp fresh_def by blast+
 
 lemma x_fresh_bv[simp]:
   fixes  x::x and bv::bv
   shows "atom x \<sharp> bv"
   using fresh_def supp_at_base by auto
 
 lemma u_not_in_x_atoms[simp]:
   fixes u::u and x::x and xs::"x set"
   shows "atom u \<notin> atom`xs"
   by (simp add: image_iff)
 
 lemma bv_not_in_x_atoms[simp]:
   fixes bv::bv and x::x and xs::"x set"
   shows "atom bv \<notin> atom`xs"
   by (simp add: image_iff)
 
 lemma u_not_in_b_atoms[simp]:
   fixes b :: b and u::u
   shows "atom u \<notin> supp b"
   by (induct b rule: b.induct,auto simp: pure_supp supp_at_base)
 
 lemma u_not_in_b_set[simp]:
   fixes  u::u and bs::"bv fset"
   shows "atom u \<notin> supp bs"
   by(induct bs, auto simp add: supp_at_base supp_finsert)
 
 lemma u_fresh_b[simp]:
   fixes  x::u and b::b
   shows "atom x \<sharp> b"
   by(induct b rule: b.induct, auto simp: pure_fresh )
 
 lemma supp_b_v_disjoint:
   fixes x::x and bv::bv
   shows "supp (V_var x) \<inter> supp (B_var bv) = {}" 
   by (simp add: supp_at_base)
 
 lemma supp_b_u_disjoint[simp]:
   fixes b::b and u::u
   shows "supp u \<inter> supp b = {}" 
   by(nominal_induct b rule:b.strong_induct,(auto simp add: pure_supp b.supp supp_at_base)+)
 
 lemma u_fresh_bv[simp]:
   fixes  u::u and b::bv
   shows "atom u \<sharp> b"
   using fresh_at_base by simp
 
 subsubsection \<open>Basic Types\<close>
 
 nominal_function b_of :: "\<tau> \<Rightarrow> b" where
   "b_of \<lbrace> z : b | c \<rbrace> = b"
      apply(auto,simp add: eqvt_def b_of_graph_aux_def )
   by (meson \<tau>.exhaust)
 nominal_termination (eqvt)  by lexicographic_order
 
 lemma supp_b_empty[simp]:
   fixes b :: b and x::x
   shows "atom x \<notin> supp b"
   by (induct b rule: b.induct, auto simp: pure_supp supp_at_base x_not_in_b_set)
 
 lemma flip_b_id[simp]:
   fixes x::x and b::b
   shows "(x \<leftrightarrow> x') \<bullet> b = b"
   by(rule flip_fresh_fresh, auto simp add: fresh_def)
 
 lemma flip_x_b_cancel[simp]:
   fixes x::x and y::x  and b::b and bv::bv
   shows "(x \<leftrightarrow> y) \<bullet> b = b" and "(x \<leftrightarrow> y) \<bullet> bv = bv"
   using flip_b_id  apply simp
   by (metis b.eq_iff(7) b.perm_simps(7) flip_b_id)
 
 lemma flip_bv_x_cancel[simp]:
   fixes bv::bv and z::bv and x::x
   shows "(bv \<leftrightarrow> z) \<bullet> x = x" using flip_fresh_fresh[of bv x z] fresh_at_base by auto
 
 lemma flip_bv_u_cancel[simp]:
   fixes bv::bv and z::bv and x::u
   shows "(bv \<leftrightarrow> z) \<bullet> x = x" using flip_fresh_fresh[of bv x z] fresh_at_base by auto
 
 subsubsection \<open>Literals\<close>
 
 lemma supp_bitvec_empty:
   fixes bv::"bit list"
   shows "supp bv = {}"
 proof(induct bv)
   case Nil
   then show ?case using supp_Nil by auto
 next
   case (Cons a bv)
   then show ?case using supp_Cons  bit.supp
-    by (metis (mono_tags, hide_lams) bit.strong_exhaust l.supp(5) sup_bot.right_neutral)
+    by (metis (mono_tags, opaque_lifting) bit.strong_exhaust l.supp(5) sup_bot.right_neutral)
 qed
 
 lemma bitvec_pure[simp]:
   fixes bv::"bit list" and x::x
   shows "atom x \<sharp> bv" using fresh_def supp_bitvec_empty by auto
 
 lemma supp_l_empty[simp]:
   fixes l:: l
   shows "supp (V_lit l) = {}"
   by(nominal_induct l rule: l.strong_induct,
       auto simp add: l.strong_exhaust pure_supp v.fv_defs supp_bitvec_empty)
 
 lemma type_l_nosupp[simp]:
   fixes x::x and l::l
   shows "atom x \<notin> supp (\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e ==  [[l]\<^sup>v]\<^sup>c\<^sup>e \<rbrace>)"
   using supp_at_base supp_l_empty ce.supp(1) c.supp \<tau>.supp by force
 
 lemma flip_bitvec0:
   fixes x::"bit list"
   assumes "atom c \<sharp> (z, x, z')"
   shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
 proof - 
   have "atom z \<sharp> x" and "atom z' \<sharp> x"
     using flip_fresh_fresh assms supp_bitvec_empty fresh_def by blast+
   moreover have "atom c \<sharp> x" using  supp_bitvec_empty fresh_def by auto
   ultimately show ?thesis  using assms flip_fresh_fresh by metis
 qed
 
 lemma flip_bitvec:
   assumes "atom c \<sharp> (z, L_bitvec x, z')"
   shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
 proof - 
   have "atom z \<sharp> x" and "atom z' \<sharp> x"
     using flip_fresh_fresh assms supp_bitvec_empty fresh_def by blast+
   moreover have "atom c \<sharp> x" using  supp_bitvec_empty fresh_def by auto
   ultimately show ?thesis  using assms flip_fresh_fresh by metis
 qed
 
 lemma type_l_eq:
   shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == [V_lit l]\<^sup>c\<^sup>e \<rbrace> = (\<lbrace> z' : b  |  [[z']\<^sup>v]\<^sup>c\<^sup>e == [V_lit l]\<^sup>c\<^sup>e \<rbrace>)"
   by(auto,nominal_induct l rule: l.strong_induct,auto, metis permute_pure, auto simp add: flip_bitvec)
 
 lemma flip_l_eq:
   fixes x::l
   shows "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x"
 proof - 
   have "atom z \<sharp> x" and "atom c \<sharp> x" and "atom z' \<sharp> x"
     using flip_fresh_fresh fresh_def supp_l_empty by fastforce+
   thus ?thesis using flip_fresh_fresh by metis
 qed
 
 lemma flip_l_eq1:
   fixes x::l
   assumes  "(z \<leftrightarrow> c) \<bullet> x = (z' \<leftrightarrow> c) \<bullet> x'"
   shows "x' = x"
 proof - 
   have "atom z \<sharp> x" and "atom c \<sharp> x'" and "atom c \<sharp> x" and "atom z' \<sharp> x'"
     using flip_fresh_fresh fresh_def supp_l_empty by fastforce+
   thus ?thesis using flip_fresh_fresh assms by metis
 qed
 
 subsubsection \<open>Types\<close>
 
 lemma flip_base_eq:
   fixes b::b and x::x and y::x                      
   shows "(x \<leftrightarrow> y) \<bullet> b = b"
   using b.fresh  by (simp add: flip_fresh_fresh fresh_def)
 
 text \<open> Obtain an alpha-equivalent type where the bound variable is fresh in some term t \<close>
 lemma has_fresh_z0:
   fixes t::"'b::fs"
   shows "\<exists>z. atom z \<sharp> (c',t) \<and> (\<lbrace>z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z' ) \<bullet> c' \<rbrace>)"
 proof -
   obtain z::x where fr: "atom z \<sharp> (c',t)" using obtain_fresh by blast
   moreover hence "(\<lbrace> z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)"  
     using \<tau>.eq_iff Abs1_eq_iff
     by (metis flip_commute flip_fresh_fresh fresh_PairD(1))
   ultimately show ?thesis by fastforce
 qed
 
 lemma has_fresh_z:
   fixes t::"'b::fs"
   shows "\<exists>z b c. atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>"
 proof -
   obtain z' and b and c' where teq: "\<tau> =  (\<lbrace> z' : b | c' \<rbrace>)" using \<tau>.exhaust by blast
   obtain z::x where fr: "atom z \<sharp> (t,c')" using obtain_fresh by blast
   hence "(\<lbrace> z' : b | c' \<rbrace>) = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)"  using \<tau>.eq_iff Abs1_eq_iff
       flip_commute flip_fresh_fresh fresh_PairD(1)  by (metis fresh_PairD(2))
   hence "atom z \<sharp> t \<and> \<tau> = (\<lbrace> z : b | (z \<leftrightarrow> z') \<bullet> c' \<rbrace>)" using fr teq by force
   thus ?thesis using teq fr by fast
 qed
 
 lemma obtain_fresh_z:
   fixes t::"'b::fs"
   obtains z and b and c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>"
   using has_fresh_z by blast
 
 lemma has_fresh_z2:
   fixes t::"'b::fs"
   shows "\<exists>z c. atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c \<rbrace>" 
 proof -
   obtain z and b and c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b | c \<rbrace>" using obtain_fresh_z by metis
   moreover then have "b_of \<tau> = b" using \<tau>.eq_iff by simp
   ultimately show ?thesis using obtain_fresh_z \<tau>.eq_iff by auto
 qed
 
 lemma obtain_fresh_z2:
   fixes t::"'b::fs"
   obtains z and  c where "atom z \<sharp> t \<and> \<tau> = \<lbrace> z : b_of \<tau> | c \<rbrace>"
   using has_fresh_z2 by blast
 
 subsubsection \<open>Values\<close>
 
 lemma u_notin_supp_v[simp]:
   fixes u::u and v::v
   shows "atom u \<notin> supp v" 
 proof(nominal_induct v rule: v.strong_induct)
   case (V_lit l)
   then show ?case  using supp_l_empty by auto
 next
   case (V_var x)
   then show ?case 
     by (simp add: supp_at_base)
 next
   case (V_pair v1 v2)
   then show ?case by auto
 next
   case (V_cons tyid list v)
   then show ?case using pure_supp by auto
 next
   case (V_consp tyid list b v)
   then show ?case using pure_supp by auto
 qed
 
 lemma u_fresh_xv[simp]:
   fixes u::u and x::x and v::v
   shows "atom u \<sharp>  (x,v)"
 proof - 
   have "atom u \<sharp> x" using fresh_def by fastforce
   moreover have "atom u \<sharp> v" using fresh_def u_notin_supp_v by metis
   ultimately show ?thesis using fresh_prod2 by auto
 qed
 
 text \<open> Part of an effort to make the proofs across inductive cases more uniform by distilling 
 the non-uniform parts into lemmas like this\<close>
 lemma v_flip_eq:
   fixes v::v and va::v and x::x and c::x
   assumes "atom c \<sharp> (v, va)" and "atom c \<sharp> (x, xa, v, va)" and "(x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> va" 
   shows "((v = V_lit l \<longrightarrow> (\<exists>l'. va = V_lit l' \<and>  (x \<leftrightarrow> c) \<bullet> l = (xa \<leftrightarrow> c) \<bullet> l'))) \<and>
          ((v = V_var y \<longrightarrow> (\<exists>y'. va = V_var y' \<and>  (x \<leftrightarrow> c) \<bullet> y = (xa \<leftrightarrow> c) \<bullet> y'))) \<and>
          ((v = V_pair vone vtwo \<longrightarrow> (\<exists>v1' v2'. va = V_pair v1' v2' \<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and>  (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2'))) \<and>
          ((v = V_cons tyid dc vone \<longrightarrow> (\<exists>v1'. va = V_cons tyid dc v1'\<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))) \<and>
          ((v = V_consp tyid dc b vone \<longrightarrow> (\<exists>v1'. va = V_consp tyid dc b v1'\<and>  (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')))" 
   using assms proof(nominal_induct v rule:v.strong_induct)
   case (V_lit l)
   then show ?case  using assms v.perm_simps 
       empty_iff flip_def fresh_def fresh_permute_iff supp_l_empty swap_fresh_fresh v.fresh 
     by (metis permute_swap_cancel2 v.distinct)
 next
   case (V_var x)
   then show ?case  using assms v.perm_simps 
       empty_iff flip_def fresh_def fresh_permute_iff supp_l_empty swap_fresh_fresh v.fresh 
     by (metis permute_swap_cancel2 v.distinct)
 next
   case (V_pair v1 v2)
   have " (V_pair v1 v2 = V_pair vone vtwo \<longrightarrow> (\<exists>v1' v2'. va = V_pair v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and> (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2'))" proof
     assume "V_pair v1 v2= V_pair vone vtwo"    
     thus  "(\<exists>v1' v2'. va = V_pair v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1' \<and> (x \<leftrightarrow> c) \<bullet> vtwo = (xa \<leftrightarrow> c) \<bullet> v2')"
       using V_pair assms 
-      by (metis (no_types, hide_lams) flip_def permute_swap_cancel v.perm_simps(3)) 
+      by (metis (no_types, opaque_lifting) flip_def permute_swap_cancel v.perm_simps(3)) 
   qed
   thus ?case using V_pair by auto
 next
   case (V_cons tyid dc v1)
   have " (V_cons tyid dc v1 = V_cons tyid dc vone \<longrightarrow> (\<exists> v1'. va = V_cons tyid dc  v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))" proof
     assume as: "V_cons tyid dc v1 = V_cons tyid dc  vone"    
     hence "(x \<leftrightarrow> c) \<bullet>  (V_cons tyid dc  vone) =  V_cons tyid dc ((x \<leftrightarrow> c) \<bullet> vone)" proof -
       have "(x \<leftrightarrow> c)  \<bullet> dc = dc" using pure_permute_id  by metis
       moreover have "(x \<leftrightarrow> c)  \<bullet> tyid = tyid" using pure_permute_id  by metis
       ultimately show ?thesis using v.perm_simps(4) by simp
     qed
     then obtain v1' where "(xa \<leftrightarrow> c) \<bullet> va = V_cons tyid dc v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using assms V_cons
       using as by fastforce
     hence " va = V_cons tyid dc ((xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using permute_flip_cancel empty_iff flip_def fresh_def supp_b_empty swap_fresh_fresh
       by (metis pure_fresh v.perm_simps(4))
 
     thus  "(\<exists>v1'. va = V_cons tyid dc  v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')"
       using V_cons assms by simp     
   qed
   thus ?case using V_cons by auto
 next
   case (V_consp tyid dc b v1)
   have " (V_consp tyid dc b v1 = V_consp tyid dc b vone \<longrightarrow> (\<exists> v1'. va = V_consp tyid dc  b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1'))" proof
     assume as: "V_consp tyid dc b v1 = V_consp tyid dc b vone"    
     hence "(x \<leftrightarrow> c) \<bullet>  (V_consp tyid dc  b vone) =  V_consp tyid dc b ((x \<leftrightarrow> c) \<bullet> vone)" proof -
       have "(x \<leftrightarrow> c)  \<bullet> dc = dc" using pure_permute_id  by metis
       moreover have "(x \<leftrightarrow> c)  \<bullet> tyid = tyid" using pure_permute_id  by metis
       ultimately show ?thesis using v.perm_simps(4) by simp
     qed
     then obtain v1' where "(xa \<leftrightarrow> c) \<bullet> va = V_consp tyid dc b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using assms V_consp
       using as by fastforce
     hence " va = V_consp tyid dc b ((xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> vone = v1'" using permute_flip_cancel empty_iff flip_def fresh_def supp_b_empty swap_fresh_fresh
         pure_fresh v.perm_simps 
-      by (metis (mono_tags, hide_lams))   
+      by (metis (mono_tags, opaque_lifting))   
     thus   "(\<exists>v1'. va = V_consp tyid dc  b v1' \<and> (x \<leftrightarrow> c) \<bullet> vone = (xa \<leftrightarrow> c) \<bullet> v1')"
       using V_consp assms by simp     
   qed
   thus ?case using V_consp by auto
 qed
 
 lemma flip_eq:
   fixes x::x and xa::x and s::"'a::fs" and sa::"'a::fs"
   assumes "(\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (x, xa, s, sa) \<longrightarrow> (x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa)" and "x \<noteq> xa"
   shows "(x \<leftrightarrow> xa) \<bullet> s = sa" 
 proof - 
   have  " ([[atom x]]lst. s = [[atom xa]]lst. sa)" using assms Abs1_eq_iff_all by simp
   hence  "(xa = x \<and> sa = s \<or> xa \<noteq> x \<and> sa = (xa \<leftrightarrow> x) \<bullet> s \<and> atom xa \<sharp> s)" using assms Abs1_eq_iff[of xa sa x s] by simp
   thus ?thesis using assms
     by (metis flip_commute)
 qed
 
 lemma  swap_v_supp:
   fixes v::v and d::x and z::x
   assumes "atom d \<sharp> v"
   shows "supp ((z \<leftrightarrow> d ) \<bullet> v) \<subseteq> supp v - { atom z } \<union> { atom d}"
   using assms
 proof(nominal_induct v rule:v.strong_induct)
   case (V_lit l)
   then show ?case using l.supp by (metis supp_l_empty empty_subsetI l.strong_exhaust pure_supp supp_eqvt v.supp)
 next
   case (V_var x)
   hence "d \<noteq> x" using fresh_def by fastforce
   thus ?case apply(cases "z = x")  using   supp_at_base V_var \<open>d\<noteq>x\<close> by fastforce+
 next
   case (V_cons tyid dc v)
   show ?case using v.supp(4) pure_supp 
     using V_cons.hyps V_cons.prems fresh_def by auto
 next
   case (V_consp tyid dc b v)
   show ?case using v.supp(4) pure_supp 
     using V_consp.hyps V_consp.prems fresh_def by auto
 qed(force+)
 
 subsubsection \<open>Expressions\<close>
 
 lemma  swap_e_supp:
   fixes e::e and d::x and z::x
   assumes "atom d \<sharp> e"
   shows "supp ((z \<leftrightarrow> d ) \<bullet> e) \<subseteq> supp e - { atom z } \<union> { atom d}"
   using assms
 proof(nominal_induct e rule:e.strong_induct)
   case (AE_val v)
   then show ?case using swap_v_supp by simp
 next
   case (AE_app f v)
   then show ?case using swap_v_supp  by (simp add: pure_supp)
 next
   case (AE_appP b f v)
   hence df: "atom d \<sharp> v" using fresh_def e.supp by force
   have  "supp ((z \<leftrightarrow> d ) \<bullet> (AE_appP b f v)) =  supp (AE_appP b f ((z \<leftrightarrow> d ) \<bullet> v))" using  e.supp 
     by (metis b.eq_iff(3) b.perm_simps(3) e.perm_simps(3) flip_b_id)
   also have "... = supp b \<union> supp f \<union> supp ((z \<leftrightarrow> d ) \<bullet> v)" using e.supp by auto
   also have "... \<subseteq>  supp b \<union> supp f \<union> supp v  - { atom z } \<union> { atom d}" using swap_v_supp[OF df] pure_supp  by auto
   finally show ?case using e.supp by auto
 next
   case (AE_op opp v1 v2)
   hence df: "atom d \<sharp> v1 \<and> atom d \<sharp> v2" using fresh_def e.supp by force
   have "((z \<leftrightarrow> d ) \<bullet> (AE_op opp v1 v2)) = AE_op opp ((z \<leftrightarrow> d ) \<bullet> v1) ((z \<leftrightarrow> d ) \<bullet> v2)" using
       e.perm_simps flip_commute opp.perm_simps AE_op opp.strong_exhaust  pure_supp
     by (metis (full_types))
 
   hence "supp ((z \<leftrightarrow> d) \<bullet> AE_op opp v1 v2) = supp (AE_op opp ((z \<leftrightarrow> d) \<bullet>v1)  ((z \<leftrightarrow> d) \<bullet>v2))" by simp
   also have "... = supp  ((z \<leftrightarrow> d) \<bullet>v1) \<union> supp  ((z \<leftrightarrow> d) \<bullet>v2)" using e.supp 
-    by (metis (mono_tags, hide_lams) opp.strong_exhaust opp.supp sup_bot.left_neutral)
+    by (metis (mono_tags, opaque_lifting) opp.strong_exhaust opp.supp sup_bot.left_neutral)
   also have "... \<subseteq> (supp v1 -  { atom z } \<union> { atom d}) \<union>  (supp v2 - { atom z } \<union> { atom d})" using swap_v_supp AE_op df by blast
   finally show ?case using e.supp opp.supp by blast
 next
   case (AE_fst v)
   then show ?case   using swap_v_supp by auto
 next
   case (AE_snd v)
   then show ?case   using swap_v_supp by auto
 next
   case (AE_mvar u)
   then show ?case using 
       Diff_empty Diff_insert0 Un_upper1 atom_x_sort flip_def flip_fresh_fresh fresh_def set_eq_subset supp_eqvt swap_set_in_eq 
     by (metis sort_of_atom_eq)
 next 
   case (AE_len v)
   then show ?case   using swap_v_supp by auto
 next
   case (AE_concat v1 v2)
   then show ?case   using swap_v_supp by auto
 next
   case (AE_split v1 v2)
   then show ?case   using swap_v_supp by auto
 qed
 
 lemma  swap_ce_supp:
   fixes e::ce and d::x and z::x
   assumes "atom d \<sharp> e"
   shows "supp ((z \<leftrightarrow> d ) \<bullet> e) \<subseteq> supp e - { atom z } \<union> { atom d}"
   using assms
 proof(nominal_induct e rule:ce.strong_induct)
   case (CE_val v)
   then show ?case using swap_v_supp ce.fresh ce.supp by simp
 next
   case (CE_op opp v1 v2)
   hence df: "atom d \<sharp> v1 \<and> atom d \<sharp> v2" using fresh_def e.supp by force
   have "((z \<leftrightarrow> d ) \<bullet> (CE_op opp v1 v2)) = CE_op opp ((z \<leftrightarrow> d ) \<bullet> v1) ((z \<leftrightarrow> d ) \<bullet> v2)" using
       ce.perm_simps flip_commute opp.perm_simps CE_op opp.strong_exhaust x_fresh_b pure_supp 
     by (metis (full_types))
 
   hence "supp ((z \<leftrightarrow> d) \<bullet> CE_op opp v1 v2) = supp (CE_op opp ((z \<leftrightarrow> d) \<bullet>v1)  ((z \<leftrightarrow> d) \<bullet>v2))" by simp
   also have "... = supp  ((z \<leftrightarrow> d) \<bullet>v1) \<union> supp  ((z \<leftrightarrow> d) \<bullet>v2)" using ce.supp 
-    by (metis (mono_tags, hide_lams) opp.strong_exhaust opp.supp sup_bot.left_neutral)
+    by (metis (mono_tags, opaque_lifting) opp.strong_exhaust opp.supp sup_bot.left_neutral)
   also have "... \<subseteq> (supp v1 -  { atom z } \<union> { atom d}) \<union>  (supp v2 - { atom z } \<union> { atom d})" using swap_v_supp CE_op df by blast
   finally show ?case using ce.supp opp.supp by blast
 next
   case (CE_fst v)
   then show ?case   using ce.supp ce.fresh swap_v_supp by auto
 next
   case (CE_snd v)
   then show ?case   using ce.supp ce.fresh swap_v_supp by auto
 next
   case (CE_len v)
   then show ?case   using ce.supp ce.fresh swap_v_supp by auto
 next
   case (CE_concat v1 v2)
   then show ?case using ce.supp ce.fresh swap_v_supp ce.perm_simps 
   proof -
     have "\<forall>x v xa. \<not> atom (x::x) \<sharp> (v::v) \<or> supp ((xa \<leftrightarrow> x) \<bullet> v) \<subseteq> supp v - {atom xa} \<union> {atom x}"
       by (meson swap_v_supp) (* 0.0 ms *)
     then show ?thesis
       using CE_concat ce.supp by auto
   qed
 qed
 
 lemma  swap_c_supp:
   fixes c::c and d::x and z::x
   assumes "atom d \<sharp> c"
   shows "supp ((z \<leftrightarrow> d ) \<bullet> c) \<subseteq> supp c - { atom z } \<union> { atom d}"
   using assms
 proof(nominal_induct c rule:c.strong_induct)
   case (C_eq e1 e2)
   then show ?case using swap_ce_supp by auto
 qed(auto+)
 
 lemma type_e_eq:
   assumes "atom z \<sharp> e" and "atom z' \<sharp> e"
   shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace> = (\<lbrace> z' : b  |  [[z']\<^sup>v]\<^sup>c\<^sup>e ==  e \<rbrace>)"
   by (auto,metis (full_types) assms(1) assms(2) flip_fresh_fresh fresh_PairD(1) fresh_PairD(2))
 
 lemma type_e_eq2:
   assumes "atom z \<sharp> e" and "atom z' \<sharp> e" and "b=b'"
   shows "\<lbrace> z : b  |  [[z]\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace> = (\<lbrace> z' : b'  |  [[z']\<^sup>v]\<^sup>c\<^sup>e == e \<rbrace>)"
   using assms type_e_eq by fast
 
 lemma e_flip_eq:
   fixes e::e and ea::e
   assumes "atom c \<sharp> (e, ea)" and "atom c \<sharp> (x, xa, e, ea)" and "(x \<leftrightarrow> c) \<bullet> e = (xa \<leftrightarrow> c) \<bullet> ea" 
   shows "(e = AE_val w \<longrightarrow> (\<exists>w'. ea = AE_val w' \<and> (x \<leftrightarrow> c) \<bullet> w = (xa \<leftrightarrow> c) \<bullet> w')) \<or> 
          (e = AE_op opp v1 v2 \<longrightarrow> (\<exists>v1' v2'. ea = AS_op opp v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> v1 = (xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> v2 = (xa \<leftrightarrow> c) \<bullet> v2') \<or> 
          (e = AE_fst v \<longrightarrow> (\<exists>v'. ea = AE_fst v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
          (e = AE_snd v \<longrightarrow> (\<exists>v'. ea = AE_snd v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
          (e = AE_len v \<longrightarrow> (\<exists>v'. ea = AE_len v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v')) \<or> 
          (e = AE_concat v1 v2 \<longrightarrow> (\<exists>v1' v2'. ea = AS_concat v1' v2' \<and> (x \<leftrightarrow> c) \<bullet> v1 = (xa \<leftrightarrow> c) \<bullet> v1') \<and> (x \<leftrightarrow> c) \<bullet> v2 = (xa \<leftrightarrow> c) \<bullet> v2') \<or> 
          (e = AE_app f v \<longrightarrow> (\<exists>v'. ea = AE_app f  v' \<and> (x \<leftrightarrow> c) \<bullet> v = (xa \<leftrightarrow> c) \<bullet> v'))"
   by (metis assms e.perm_simps permute_flip_cancel2)
 
 lemma fresh_opp_all:
   fixes opp::opp
   shows "z \<sharp> opp"
   using e.fresh opp.exhaust opp.fresh  by metis
 
 lemma fresh_e_opp_all:
   shows "(z \<sharp> v1 \<and> z \<sharp> v2) = z \<sharp> AE_op opp v1 v2"
   using e.fresh opp.exhaust opp.fresh fresh_opp_all by simp
 
 lemma fresh_e_opp:
   fixes z::x
   assumes "atom z \<sharp> v1 \<and> atom z \<sharp> v2"
   shows "atom z \<sharp> AE_op opp v1 v2"
   using e.fresh opp.exhaust opp.fresh opp.supp  by (metis assms)
 
 subsubsection \<open>Statements\<close>
 
 lemma branch_s_flip_eq:
   fixes v::v and va::v
   assumes "atom c \<sharp> (v, va)" and "atom c \<sharp> (x, xa, v, va)" and "(x \<leftrightarrow> c) \<bullet> s = (xa \<leftrightarrow> c) \<bullet> sa" 
   shows "(s = AS_val w \<longrightarrow> (\<exists>w'. sa = AS_val w' \<and> (x \<leftrightarrow> c) \<bullet> w = (xa \<leftrightarrow> c) \<bullet> w')) \<or> 
          (s = AS_seq s1 s2 \<longrightarrow> (\<exists>s1' s2'. sa = AS_seq s1' s2' \<and> (x \<leftrightarrow> c) \<bullet> s1 = (xa \<leftrightarrow> c) \<bullet> s1') \<and> (x \<leftrightarrow> c) \<bullet> s2 = (xa \<leftrightarrow> c) \<bullet> s2') \<or> 
          (s = AS_if v s1 s2 \<longrightarrow> (\<exists>v' s1' s2'. sa = AS_if seq s1' s2' \<and> (x \<leftrightarrow> c) \<bullet> s1 = (xa \<leftrightarrow> c) \<bullet> s1') \<and> (x \<leftrightarrow> c) \<bullet> s2 = (xa \<leftrightarrow> c) \<bullet> s2' \<and> (x \<leftrightarrow> c) \<bullet> c = (xa \<leftrightarrow> c) \<bullet> v')"
   by (metis assms s_branch_s_branch_list.perm_simps permute_flip_cancel2)
 
 section \<open>Context Syntax\<close>
 
 subsection \<open>Datatypes\<close>
 
 text \<open>Type and function/type definition contexts\<close>
 type_synonym \<Phi> = "fun_def list"
 type_synonym \<Theta> = "type_def list"
 type_synonym \<B> = "bv fset"
 
 datatype \<Gamma> = 
   GNil
   | GCons "x*b*c" \<Gamma>  (infixr "#\<^sub>\<Gamma>" 65)
 
 datatype \<Delta> = 
   DNil  ("[]\<^sub>\<Delta>")
   | DCons "u*\<tau>" \<Delta>  (infixr "#\<^sub>\<Delta>" 65)
 
 subsection \<open>Functions and Lemmas\<close>
 
 lemma \<Gamma>_induct [case_names GNil GCons] : "P GNil \<Longrightarrow> (\<And>x b c \<Gamma>'. P \<Gamma>' \<Longrightarrow> P ((x,b,c) #\<^sub>\<Gamma> \<Gamma>')) \<Longrightarrow> P \<Gamma>"
 proof(induct \<Gamma> rule:\<Gamma>.induct)
   case GNil
   then show ?case by auto 
 next
   case (GCons x1 x2)
   then obtain x and b and c where "x1=(x,b,c)"  using prod_cases3 by blast
   then show ?case using GCons by presburger
 qed
 
 instantiation \<Delta> ::  pt
 begin
 
 primrec permute_\<Delta>
   where
     DNil_eqvt:  "p \<bullet> DNil = DNil"
   | DCons_eqvt: "p \<bullet> (x #\<^sub>\<Delta> xs) = p \<bullet> x #\<^sub>\<Delta> p \<bullet> (xs::\<Delta>)"
 
 instance  by standard (induct_tac [!] x, simp_all)
 end
 
 lemmas [eqvt] =  permute_\<Delta>.simps 
 
 lemma \<Delta>_induct [case_names DNil DCons] : "P DNil \<Longrightarrow> (\<And>u t \<Delta>'. P \<Delta>' \<Longrightarrow> P ((u,t) #\<^sub>\<Delta> \<Delta>')) \<Longrightarrow> P \<Delta>"
 proof(induct \<Delta> rule: \<Delta>.induct)
   case DNil
   then show ?case by auto 
 next
   case (DCons x1 x2)
   then obtain u and t  where "x1=(u,t)"  by fastforce
   then show ?case using DCons by presburger
 qed
 
 lemma \<Phi>_induct [case_names PNil PConsNone PConsSome] : "P [] \<Longrightarrow> (\<And>f x b c \<tau> s' \<Phi>'. P \<Phi>' \<Longrightarrow> P ((AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s'))) # \<Phi>')) \<Longrightarrow>
                                                                   (\<And>f bv x b c \<tau> s' \<Phi>'. P \<Phi>' \<Longrightarrow> P ((AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s'))) # \<Phi>'))  \<Longrightarrow> P \<Phi>"
 proof(induct \<Phi> rule: list.induct)
   case Nil
   then show ?case by auto 
 next
   case (Cons x1 x2)
   then obtain f and t where ft: "x1 = (AF_fundef f t)" 
     by (meson fun_def.exhaust)
   then show ?case proof(nominal_induct t rule:fun_typ_q.strong_induct)
     case (AF_fun_typ_some bv ft)
     then show ?case using Cons ft 
       by (metis fun_typ.exhaust)
   next
     case (AF_fun_typ_none ft)
     then show ?case using Cons ft 
       by (metis fun_typ.exhaust)
   qed
 qed
 
 lemma \<Theta>_induct [case_names TNil AF_typedef AF_typedef_poly] : "P [] \<Longrightarrow> (\<And>tid dclist \<Theta>'. P \<Theta>' \<Longrightarrow> P ((AF_typedef tid dclist) # \<Theta>')) \<Longrightarrow>
                                                                   (\<And>tid bv dclist \<Theta>'. P \<Theta>' \<Longrightarrow> P ((AF_typedef_poly tid bv dclist ) # \<Theta>'))  \<Longrightarrow> P \<Theta>"
 proof(induct \<Theta> rule: list.induct)
   case Nil
   then show ?case by auto
 next
   case (Cons td T)
   show ?case by(cases td rule: type_def.exhaust, (simp add: Cons)+)
 qed
 
 instantiation \<Gamma> ::  pt
 begin
 
 primrec permute_\<Gamma>
   where
     GNil_eqvt:  "p \<bullet> GNil = GNil"
   | GCons_eqvt: "p \<bullet> (x #\<^sub>\<Gamma> xs) = p \<bullet> x #\<^sub>\<Gamma> p \<bullet> (xs::\<Gamma>)"
 
 instance by standard (induct_tac [!] x, simp_all)
 end
 
 lemmas [eqvt] =  permute_\<Gamma>.simps 
 
 lemma G_cons_eqvt[simp]:
   fixes \<Gamma>::\<Gamma>
   shows "p \<bullet> ((x,b,c) #\<^sub>\<Gamma> \<Gamma>) = ((p \<bullet> x,  p \<bullet> b , p \<bullet> c) #\<^sub>\<Gamma> (p \<bullet> \<Gamma> ))" (is "?A = ?B" )
   using Cons_eqvt triple_eqvt  supp_b_empty by simp
 
 lemma G_cons_flip[simp]:
   fixes  x::x and \<Gamma>::\<Gamma>
   shows  "(x\<leftrightarrow>x') \<bullet> ((x'',b,c) #\<^sub>\<Gamma> \<Gamma>) = (((x\<leftrightarrow>x') \<bullet> x'',  b , (x\<leftrightarrow>x') \<bullet> c) #\<^sub>\<Gamma> ((x\<leftrightarrow>x') \<bullet> \<Gamma> ))" 
   using Cons_eqvt triple_eqvt  supp_b_empty by auto
 
 lemma G_cons_flip_fresh[simp]:
   fixes  x::x and \<Gamma>::\<Gamma> 
   assumes  "atom x \<sharp> (c,\<Gamma>)" and "atom x' \<sharp> (c,\<Gamma>)" 
   shows  "(x\<leftrightarrow>x') \<bullet> ((x',b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x,  b , c) #\<^sub>\<Gamma> \<Gamma> )" 
   using G_cons_flip flip_fresh_fresh assms by force
 
 lemma G_cons_flip_fresh2[simp]:
   fixes  x::x and \<Gamma>::\<Gamma> 
   assumes  "atom x \<sharp> (c,\<Gamma>)" and "atom x' \<sharp> (c,\<Gamma>)" 
   shows  "(x\<leftrightarrow>x') \<bullet> ((x,b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x',  b , c) #\<^sub>\<Gamma> \<Gamma> )" 
   using G_cons_flip flip_fresh_fresh assms by force
 
 lemma G_cons_flip_fresh3[simp]:
   fixes  x::x and \<Gamma>::\<Gamma> 
   assumes  "atom x \<sharp> \<Gamma>" and "atom x' \<sharp> \<Gamma>" 
   shows  "(x\<leftrightarrow>x') \<bullet> ((x',b,c) #\<^sub>\<Gamma> \<Gamma>) = ((x,  b , (x\<leftrightarrow>x') \<bullet> c) #\<^sub>\<Gamma> \<Gamma> )" 
   using G_cons_flip flip_fresh_fresh assms by force
 
 lemma neq_GNil_conv: "(xs \<noteq> GNil) = (\<exists>y ys. xs = y #\<^sub>\<Gamma> ys)"
   by (induct xs) auto
 
 nominal_function toList :: "\<Gamma> \<Rightarrow> (x*b*c) list" where
   "toList GNil = []"
 | "toList (GCons xbc G) = xbc#(toList G)"
        apply (auto, simp add: eqvt_def toList_graph_aux_def )
   using neq_GNil_conv surj_pair by metis
 nominal_termination (eqvt)
   by lexicographic_order
 
 nominal_function toSet :: "\<Gamma> \<Rightarrow> (x*b*c) set" where
   "toSet GNil = {}"
 | "toSet (GCons xbc G) = {xbc} \<union> (toSet G)"
        apply (auto,simp add: eqvt_def toSet_graph_aux_def )
   using neq_GNil_conv surj_pair by metis
 nominal_termination (eqvt)
   by lexicographic_order
 
 nominal_function append_g :: "\<Gamma> \<Rightarrow> \<Gamma> \<Rightarrow> \<Gamma>" (infixr "@" 65) where
   "append_g GNil g = g"
 | "append_g (xbc #\<^sub>\<Gamma> g1) g2 = (xbc #\<^sub>\<Gamma> (g1@g2))"
        apply (auto,simp add: eqvt_def append_g_graph_aux_def )
   using neq_GNil_conv surj_pair by metis
 nominal_termination (eqvt) by lexicographic_order
 
 nominal_function dom  ::  "\<Gamma> \<Rightarrow> x set"  where
   "dom \<Gamma> = (fst` (toSet \<Gamma>))"
      apply auto
   unfolding  eqvt_def dom_graph_aux_def lfp_eqvt toSet.eqvt by simp
 nominal_termination (eqvt) by lexicographic_order
 
 text \<open> Use of this is sometimes mixed in with use of freshness and support for the context however it makes it clear
 that for immutable variables, the context is `self-supporting'\<close>
 
 nominal_function atom_dom  ::  "\<Gamma> \<Rightarrow> atom set"  where
   "atom_dom \<Gamma>  = atom`(dom  \<Gamma>)"
      apply auto
   unfolding  eqvt_def atom_dom_graph_aux_def lfp_eqvt toSet.eqvt by simp
 nominal_termination (eqvt) by lexicographic_order
 
 subsection \<open>Immutable Variable Context Lemmas\<close>
 
 lemma append_GNil[simp]:
   "GNil @ G = G"
   by simp
 
 lemma append_g_toSetU [simp]: "toSet (G1@G2) = toSet G1 \<union> toSet G2"
   by(induct G1, auto+)
 
 lemma supp_GNil: 
   shows "supp GNil = {}"
   by (simp add: supp_def)
 
 lemma supp_GCons: 
   fixes xs::\<Gamma>
   shows "supp (x #\<^sub>\<Gamma> xs) = supp x \<union> supp xs"
   by (simp add: supp_def Collect_imp_eq Collect_neg_eq)
 
 lemma atom_dom_eq[simp]: 
   fixes G::\<Gamma>
   shows  "atom_dom ((x, b, c) #\<^sub>\<Gamma> G) = atom_dom ((x, b, c') #\<^sub>\<Gamma> G)" 
   using atom_dom.simps toSet.simps by simp
 
 lemma dom_append[simp]:
   "atom_dom (\<Gamma>@\<Gamma>') = atom_dom \<Gamma> \<union> atom_dom \<Gamma>'"
   using image_Un append_g_toSetU atom_dom.simps dom.simps by metis
 
 lemma dom_cons[simp]:
   "atom_dom ((x,b,c) #\<^sub>\<Gamma> G) = { atom x } \<union> atom_dom G"
   using image_Un append_g_toSetU atom_dom.simps by auto
 
 lemma fresh_GNil[ms_fresh]: 
   shows "a \<sharp> GNil"
   by (simp add: fresh_def supp_GNil)
 
 lemma fresh_GCons[ms_fresh]: 
   fixes xs::\<Gamma>
   shows "a \<sharp> (x #\<^sub>\<Gamma> xs) \<longleftrightarrow> a \<sharp> x \<and> a \<sharp> xs"
   by (simp add: fresh_def supp_GCons)
 
 lemma dom_supp_g[simp]:
   "atom_dom G \<subseteq> supp G"
   apply(induct G rule: \<Gamma>_induct,simp)
   using supp_at_base supp_Pair atom_dom.simps supp_GCons by fastforce
 
 lemma fresh_append_g[ms_fresh]:
   fixes xs::\<Gamma>
   shows "a \<sharp> (xs @ ys) \<longleftrightarrow> a \<sharp> xs \<and> a \<sharp> ys"
   by (induct xs) (simp_all add: fresh_GNil fresh_GCons)
 
 lemma append_g_assoc:
   fixes xs::\<Gamma> 
   shows  "(xs @ ys) @ zs = xs @ (ys @ zs)"
   by (induct xs) simp_all
 
 lemma append_g_inside:
   fixes xs::\<Gamma> 
   shows "xs @ (x #\<^sub>\<Gamma> ys) = (xs @ (x #\<^sub>\<Gamma> GNil)) @ ys"
   by(induct xs,auto+)
 
 lemma finite_\<Gamma>:
   "finite (toSet \<Gamma>)" 
   by(induct \<Gamma> rule: \<Gamma>_induct,auto)
 
 lemma supp_\<Gamma>:
   "supp \<Gamma> = supp (toSet \<Gamma>)"
 proof(induct \<Gamma> rule: \<Gamma>_induct)
   case GNil
   then show ?case using supp_GNil toSet.simps
     by (simp add: supp_set_empty)
 next
   case (GCons x b c \<Gamma>')
   then show ?case using  supp_GCons toSet.simps finite_\<Gamma> supp_of_finite_union 
     using supp_of_finite_insert by fastforce
 qed
 
 lemma supp_of_subset:
   fixes G::"('a::fs set)"
   assumes "finite G" and "finite G'" and "G \<subseteq> G'" 
   shows "supp G \<subseteq> supp G'"
   using supp_of_finite_sets assms  by (metis subset_Un_eq supp_of_finite_union)
 
 lemma supp_weakening:
   assumes "toSet G \<subseteq> toSet G'"
   shows "supp G \<subseteq> supp G'"
   using supp_\<Gamma> finite_\<Gamma> by (simp add: supp_of_subset assms)
 
 lemma fresh_weakening[ms_fresh]:
   assumes "toSet G \<subseteq> toSet G'" and "x \<sharp> G'" 
   shows "x \<sharp> G"
 proof(rule ccontr)
   assume "\<not> x \<sharp> G"
   hence "x \<in> supp G" using fresh_def by auto
   hence "x \<in> supp G'" using supp_weakening assms by auto
   thus False using fresh_def assms by auto
 qed
 
 instance \<Gamma> :: fs
   by (standard, induct_tac x, simp_all add: supp_GNil supp_GCons  finite_supp)
 
 lemma fresh_gamma_elem:
   fixes \<Gamma>::\<Gamma>
   assumes "a \<sharp> \<Gamma>"
     and "e \<in> toSet \<Gamma>"
   shows "a \<sharp> e"
   using assms by(induct \<Gamma>,auto simp add: fresh_GCons)
 
 lemma fresh_gamma_append:
   fixes xs::\<Gamma>
   shows "a \<sharp> (xs @ ys) \<longleftrightarrow> a \<sharp> xs \<and> a \<sharp> ys"
   by (induct xs, simp_all add: fresh_GNil fresh_GCons)
 
 lemma supp_triple[simp]:
   shows "supp (x, y, z) = supp x \<union> supp y \<union> supp z"
 proof -
   have "supp (x,y,z) = supp (x,(y,z))"  by auto
   hence "supp (x,y,z) = supp x \<union> (supp y  \<union> supp z)" using supp_Pair by metis
   thus ?thesis by auto
 qed
 
 lemma supp_append_g:
   fixes xs::\<Gamma>
   shows "supp (xs @ ys) = supp xs \<union> supp ys"
   by(induct xs,auto simp add: supp_GNil supp_GCons )
 
 lemma fresh_in_g[simp]:
   fixes \<Gamma>::\<Gamma> and x'::x
   shows "atom x' \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> = (atom x' \<notin> supp \<Gamma>' \<union> supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma>)"
 proof - 
   have  "atom x' \<sharp> \<Gamma>' @ (x, b0, c0) #\<^sub>\<Gamma> \<Gamma> = (atom x' \<notin> supp (\<Gamma>' @((x,b0,c0) #\<^sub>\<Gamma> \<Gamma>)))"
     using fresh_def by auto
   also have "... = (atom x' \<notin> supp \<Gamma>' \<union> supp ((x,b0,c0) #\<^sub>\<Gamma> \<Gamma>))" using supp_append_g by fast
   also have "... = (atom x' \<notin> supp \<Gamma>' \<union> supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma>)" using supp_GCons supp_append_g supp_triple  by auto
   finally show ?thesis by fast
 qed
 
 lemma fresh_suffix[ms_fresh]:
   fixes \<Gamma>::\<Gamma>
   assumes "atom x \<sharp> \<Gamma>'@\<Gamma>"
   shows "atom x \<sharp> \<Gamma>"
   using assms by(induct  \<Gamma>' rule: \<Gamma>_induct, auto simp add: append_g.simps fresh_GCons)
 
 lemma not_GCons_self [simp]:
   fixes xs::\<Gamma>
   shows "xs \<noteq> x #\<^sub>\<Gamma> xs"
   by (induct xs) auto
 
 lemma not_GCons_self2 [simp]: 
   fixes xs::\<Gamma>
   shows "x #\<^sub>\<Gamma> xs \<noteq> xs"
   by (rule not_GCons_self [symmetric])
 
 lemma fresh_restrict:
   fixes y::x and \<Gamma>::\<Gamma>
   assumes  "atom y \<sharp>  (\<Gamma>' @ (x, b, c) #\<^sub>\<Gamma> \<Gamma>)"
   shows "atom y \<sharp> (\<Gamma>'@\<Gamma>)"
   using assms by(induct \<Gamma>' rule: \<Gamma>_induct, auto simp add:fresh_GCons fresh_GNil  )
 
 lemma fresh_dom_free:
   assumes "atom x \<sharp> \<Gamma>" 
   shows "(x,b,c) \<notin> toSet \<Gamma>"
   using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x' b' c' \<Gamma>')
   hence "x\<noteq>x'" using fresh_def fresh_GCons fresh_Pair supp_at_base by blast
   moreover have "atom x \<sharp> \<Gamma>'" using fresh_GCons GCons by auto
   ultimately show ?case using toSet.simps GCons by auto
 qed
 
 lemma \<Gamma>_set_intros: "x \<in> toSet ( x #\<^sub>\<Gamma> xs)" and "y \<in> toSet xs \<Longrightarrow> y \<in> toSet (x #\<^sub>\<Gamma> xs)"
   by simp+
 
 lemma fresh_dom_free2:
   assumes "atom x \<notin> atom_dom \<Gamma>" 
   shows "(x,b,c) \<notin> toSet \<Gamma>"
   using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x' b' c' \<Gamma>')
   hence "x\<noteq>x'" using fresh_def fresh_GCons fresh_Pair supp_at_base by auto
   moreover have "atom x \<notin> atom_dom \<Gamma>'" using fresh_GCons GCons by auto
   ultimately show ?case using toSet.simps GCons by auto
 qed
 
 subsection \<open>Mutable Variable Context Lemmas\<close>
 
 lemma supp_DNil: 
   shows "supp DNil = {}"
   by (simp add: supp_def)
 
 lemma supp_DCons: 
   fixes xs::\<Delta>
   shows "supp (x #\<^sub>\<Delta> xs) = supp x \<union> supp xs"
   by (simp add: supp_def Collect_imp_eq Collect_neg_eq)
 
 lemma fresh_DNil[ms_fresh]:
   shows "a \<sharp> DNil"
   by (simp add: fresh_def supp_DNil)
 
 lemma fresh_DCons[ms_fresh]: 
   fixes xs::\<Delta>
   shows "a \<sharp> (x #\<^sub>\<Delta> xs) \<longleftrightarrow> a \<sharp> x \<and> a \<sharp> xs"
   by (simp add: fresh_def supp_DCons)
 
 instance \<Delta> :: fs
   by (standard, induct_tac x, simp_all add: supp_DNil supp_DCons  finite_supp)
 
 subsection \<open>Lookup Functions\<close>
 
 nominal_function lookup :: "\<Gamma> \<Rightarrow> x \<Rightarrow> (b*c) option" where
   "lookup GNil x = None"
 | "lookup ((x,b,c)#\<^sub>\<Gamma>G) y = (if x=y then Some (b,c) else lookup G y)"
   by (auto,simp add: eqvt_def lookup_graph_aux_def, metis neq_GNil_conv surj_pair)
 nominal_termination (eqvt) by lexicographic_order
 
 nominal_function replace_in_g :: "\<Gamma> \<Rightarrow> x \<Rightarrow> c \<Rightarrow> \<Gamma>"  ("_[_\<longmapsto>_]" [1000,0,0] 200) where
   "replace_in_g GNil _ _ = GNil"
 | "replace_in_g ((x,b,c)#\<^sub>\<Gamma>G) x' c' = (if x=x' then ((x,b,c')#\<^sub>\<Gamma>G) else (x,b,c)#\<^sub>\<Gamma>(replace_in_g G x' c'))"
        apply(auto,simp add: eqvt_def replace_in_g_graph_aux_def)
   using surj_pair \<Gamma>.exhaust by metis
 nominal_termination (eqvt) by lexicographic_order
 
 text \<open> Functions for looking up data-constructors in the Pi context \<close> 
 
 nominal_function lookup_fun :: "\<Phi> \<Rightarrow> f  \<Rightarrow> fun_def option" where
   "lookup_fun [] g = None"
 |  "lookup_fun ((AF_fundef f ft)#\<Pi>) g = (if (f=g) then Some (AF_fundef f ft) else lookup_fun \<Pi> g)"
        apply(auto,simp add: eqvt_def lookup_fun_graph_aux_def )
   by (metis fun_def.exhaust neq_Nil_conv)
 nominal_termination (eqvt)  by lexicographic_order
 
 nominal_function lookup_td :: "\<Theta> \<Rightarrow> string  \<Rightarrow> type_def option" where
   "lookup_td [] g = None"
 |  "lookup_td ((AF_typedef s lst ) # (\<Theta>::\<Theta>)) g = (if (s = g) then Some (AF_typedef s lst ) else lookup_td \<Theta> g)"
 |  "lookup_td ((AF_typedef_poly s bv lst ) # (\<Theta>::\<Theta>)) g = (if (s = g) then Some (AF_typedef_poly s bv lst ) else lookup_td \<Theta> g)"
           apply(auto,simp add: eqvt_def lookup_td_graph_aux_def )
   by (metis type_def.exhaust neq_Nil_conv)
 nominal_termination (eqvt)  by lexicographic_order
 
 nominal_function name_of_type  ::"type_def \<Rightarrow> f "  where
   "name_of_type (AF_typedef f _ ) = f"
 | "name_of_type (AF_typedef_poly f _ _) = f"
        apply(auto,simp add: eqvt_def name_of_type_graph_aux_def )
   using type_def.exhaust by blast
 nominal_termination (eqvt)  by lexicographic_order
 
 nominal_function name_of_fun  ::"fun_def \<Rightarrow> f "  where
   "name_of_fun  (AF_fundef f ft) = f"
      apply(auto,simp add: eqvt_def name_of_fun_graph_aux_def )
   using fun_def.exhaust by blast
 nominal_termination (eqvt)  by lexicographic_order
 
 nominal_function remove2 :: "'a::pt \<Rightarrow> 'a list \<Rightarrow> 'a list" where
   "remove2 x [] = []" |
   "remove2 x (y # xs) = (if x = y then xs else y # remove2 x xs)"
   by (simp add: eqvt_def remove2_graph_aux_def,auto+,meson list.exhaust)
 nominal_termination (eqvt)  by lexicographic_order
 
 nominal_function base_for_lit :: "l \<Rightarrow> b" where
   "base_for_lit (L_true) = B_bool "
 | "base_for_lit (L_false) = B_bool "
 | "base_for_lit (L_num n) = B_int "
 | "base_for_lit (L_unit) = B_unit " 
 | "base_for_lit (L_bitvec v) = B_bitvec"
                    apply (auto simp: eqvt_def base_for_lit_graph_aux_def )
   using l.strong_exhaust by blast
 nominal_termination (eqvt) by lexicographic_order
 
 lemma neq_DNil_conv: "(xs \<noteq> DNil) = (\<exists>y ys. xs = y #\<^sub>\<Delta> ys)"
   by (induct xs) auto
 
 nominal_function setD :: "\<Delta> \<Rightarrow> (u*\<tau>) set" where
   "setD DNil = {}"
 | "setD (DCons xbc G) = {xbc} \<union> (setD G)"
        apply (auto,simp add: eqvt_def setD_graph_aux_def )
   using neq_DNil_conv surj_pair by metis
 nominal_termination (eqvt) by lexicographic_order
 
 lemma eqvt_triple:
   fixes y::"'a::at" and ya::"'a::at" and xa::"'c::at" and va::"'d::fs" and s::s and sa::s and f::"s*'c*'d \<Rightarrow> s"
   assumes "atom y \<sharp> (xa, va)" and "atom ya \<sharp> (xa, va)" and 
     "\<forall>c. atom c \<sharp> (s, sa) \<longrightarrow> atom c \<sharp> (y, ya, s, sa) \<longrightarrow> (y \<leftrightarrow> c) \<bullet> s = (ya \<leftrightarrow> c) \<bullet> sa"
     and "eqvt_at f (s,xa,va)" and "eqvt_at f (sa,xa,va)" and
     "atom c \<sharp> (s, va, xa, sa)" and "atom c \<sharp> (y, ya, f (s, xa, va), f (sa, xa, va))"
   shows "(y \<leftrightarrow> c) \<bullet> f (s, xa, va) =  (ya \<leftrightarrow> c) \<bullet> f (sa, xa, va)"
 proof -
   have " (y \<leftrightarrow> c) \<bullet> f (s, xa, va) = f ( (y \<leftrightarrow> c) \<bullet> (s,xa,va))" using assms eqvt_at_def by metis
   also have "... = f ( (y \<leftrightarrow> c) \<bullet> s, (y \<leftrightarrow> c) \<bullet> xa ,(y \<leftrightarrow> c) \<bullet> va)" by auto
   also have "... = f ( (ya \<leftrightarrow> c) \<bullet> sa, (ya \<leftrightarrow> c) \<bullet> xa ,(ya \<leftrightarrow> c) \<bullet> va)" proof - 
     have " (y \<leftrightarrow> c) \<bullet> s = (ya \<leftrightarrow> c) \<bullet> sa" using assms Abs1_eq_iff_all by auto
     moreover have  "((y \<leftrightarrow> c) \<bullet> xa) =  ((ya \<leftrightarrow> c) \<bullet> xa)" using assms flip_fresh_fresh fresh_prodN by metis
     moreover have  "((y \<leftrightarrow> c) \<bullet> va) =  ((ya \<leftrightarrow> c) \<bullet> va)" using assms flip_fresh_fresh fresh_prodN by metis
     ultimately show ?thesis by auto
   qed
   also have "... =  f ( (ya \<leftrightarrow> c) \<bullet> (sa,xa,va))" by auto
   finally show ?thesis using assms eqvt_at_def by metis
 qed
 
 section \<open>Functions for bit list/vectors\<close>
 
 inductive split :: "int \<Rightarrow> bit list \<Rightarrow> bit list * bit list \<Rightarrow> bool" where
   "split 0 xs ([], xs)"
 | "split m xs (ys,zs) \<Longrightarrow> split (m+1) (x#xs) ((x # ys), zs)"
 equivariance split
 nominal_inductive split .
 
 lemma split_concat:
   assumes "split n v (v1,v2)"
   shows "v = append v1 v2"
   using assms proof(induct "(v1,v2)" arbitrary: v1 v2 rule: split.inducts)
   case 1
   then show ?case by auto
 next
   case (2 m xs ys zs x)
   then show ?case by auto
 qed
 
 lemma split_n:
   assumes "split n v (v1,v2)"
   shows "0 \<le> n \<and> n \<le> int (length v)"
   using assms proof(induct rule: split.inducts)
   case (1 xs)
   then show ?case by auto
 next
   case (2 m xs ys zs x)
   then show ?case by auto
 qed
 
 lemma split_length:
   assumes "split n v (v1,v2)"
   shows "n = int (length v1)"
   using assms proof(induct  "(v1,v2)" arbitrary: v1 v2 rule: split.inducts)
   case (1 xs)
   then show ?case by auto
 next
   case (2 m xs ys zs x)
   then show ?case by auto
 qed
 
 lemma obtain_split:
   assumes "0 \<le> n" and "n \<le> int (length bv)" 
   shows "\<exists> bv1 bv2. split n bv (bv1 , bv2)" 
   using assms proof(induct bv arbitrary: n)
   case Nil
   then show ?case using split.intros by auto
 next
   case (Cons b bv)
   show ?case proof(cases "n = 0")
     case True
     then show ?thesis using split.intros by auto
   next
     case False
     then obtain m where m:"n=m+1" using Cons 
       by (metis add.commute add_minus_cancel)
     moreover have "0 \<le> m" using False m Cons by linarith
     then obtain bv1 and bv2 where "split m bv (bv1 , bv2)" using Cons m by force
     hence "split n (b # bv) ((b#bv1), bv2)" using m split.intros by auto
     then show ?thesis by auto
   qed
 qed
 
 end
\ No newline at end of file
diff --git a/thys/MiniSail/WellformedL.thy b/thys/MiniSail/WellformedL.thy
--- a/thys/MiniSail/WellformedL.thy
+++ b/thys/MiniSail/WellformedL.thy
@@ -1,4755 +1,4755 @@
 (*<*)
 theory WellformedL
   imports Wellformed "SyntaxL"
 begin                                                                                                                                                                                   
 (*>*)
 
 chapter \<open>Wellformedness Lemmas\<close>
 
 section \<open>Prelude\<close>
 
 lemma b_of_subst_bb_commute:
    "(b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)) =  (b_of \<tau>)[bv::=b]\<^sub>b\<^sub>b"
 proof -
   obtain z' and b' and c' where "\<tau> = \<lbrace> z' : b' | c' \<rbrace> " using obtain_fresh_z by metis
   moreover hence "(b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b)) = b_of \<lbrace> z' : b'[bv::=b]\<^sub>b\<^sub>b | c' \<rbrace>" using subst_tb.simps by simp
   ultimately show ?thesis using subst_tv.simps subst_tb.simps by simp
 qed
 
 lemmas wf_intros = wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.intros wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.intros
 
 lemmas freshers = fresh_prodN b.fresh c.fresh v.fresh ce.fresh fresh_GCons fresh_GNil fresh_at_base 
 
 section \<open>Strong Elimination\<close>
 
 text \<open>Inversion/elimination for well-formed polymorphic constructors \<close>
 lemma wf_strong_elim:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" 
            and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s and tm::"'a::fs" 
           and cs::branch_s and css::branch_list and \<Theta>::\<Theta>
    shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (V_consp tyid dc b v) : b'' \<Longrightarrow> (\<exists> bv dclist x b' c. b'' = B_app tyid b \<and>
              AF_typedef_poly tyid bv dclist \<in> set \<Theta> \<and>
             (dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist \<and>
                \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b  \<and> atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>, b, v) \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<and> atom bv \<sharp> tm)" and           
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> True" and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and       
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and      
          "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> True" and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
 proof(nominal_induct
       "V_consp tyid dc b v" b'' and c and \<Gamma> and \<tau> and ts and \<Theta> and b and b' and td 
      avoiding: tm
   
 rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfV_conspI bv dclist \<Theta> x b' c \<B> \<Gamma>)
   then show ?case by force
 qed(auto+)
 
 section \<open>Context Extension\<close>
 
 definition wfExt :: "\<Theta> \<Rightarrow> \<B> \<Rightarrow> \<Gamma> \<Rightarrow> \<Gamma> \<Rightarrow> bool" (" _ ; _  \<turnstile>\<^sub>w\<^sub>f _ < _ " [50,50,50] 50)   where
   "wfExt T B G1 G2 = (wfG T B G2 \<and> wfG T B G1 \<and> toSet G1 \<subseteq> toSet G2)" 
 
 section \<open>Context\<close>
 
 lemma wfG_cons[ms_wb]:
   fixes \<Gamma>::\<Gamma>
   assumes "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>"
   shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> atom z \<sharp> \<Gamma> \<and> wfB P \<B> b" 
   using wfG_elims(2)[OF assms] by metis
 
 lemma wfG_cons2[ms_wb]:
   fixes \<Gamma>::\<Gamma>
   assumes "P; \<B>  \<turnstile>\<^sub>w\<^sub>f zbc  #\<^sub>\<Gamma>\<Gamma>"
   shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" 
 proof -
   obtain z and b and c where zbc: "zbc=(z,b,c)" using prod_cases3 by blast
   hence  "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>" using assms by auto
   thus ?thesis using zbc wfG_cons assms by simp
 qed
 
 lemma wf_g_unique: 
   fixes \<Gamma>::\<Gamma>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma>" and "(x,b,c) \<in> toSet \<Gamma>" and "(x,b',c') \<in> toSet \<Gamma>"
   shows "b=b' \<and> c=c'"
 using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
   case GNil
   then show ?case by simp
 next
   case (GCons a \<Gamma>)
   consider "(x,b,c)=a \<and> (x,b',c')=a" | "(x,b,c)=a \<and> (x,b',c')\<noteq>a" | "(x,b,c)\<noteq>a \<and> (x,b',c')=a" | "(x,b,c)\<noteq> a \<and> (x,b',c')\<noteq>a" by blast
   then show ?case proof(cases)
     case 1
     then show ?thesis  by auto
   next
     case 2
     hence "atom x \<sharp> \<Gamma>"  using wfG_elims(2) GCons by blast
     moreover have "(x,b',c') \<in> toSet \<Gamma>" using GCons 2 by force
     ultimately show ?thesis    using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 2 GCons by metis
   next
     case 3
     hence "atom x \<sharp> \<Gamma>"  using wfG_elims(2) GCons by blast
     moreover have "(x,b,c) \<in> toSet \<Gamma>" using GCons 3 by force
     ultimately show ?thesis
            using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 3 GCons by metis
   next
     case 4
     then obtain x'' and b'' and c''::c where xbc: "a=(x'',b'',c'')" 
       using prod_cases3 by blast
     hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x'',b'',c'')  #\<^sub>\<Gamma>\<Gamma>)" using GCons wfG_elims by blast
     hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> (x, b, c) \<in> toSet \<Gamma> \<and> (x, b', c') \<in> toSet \<Gamma>"  using  GCons wfG_elims 4 xbc
           prod_cases3 set_GConsD   using forget_subst_gv fresh_GCons fresh_GNil fresh_gamma_elem \<Gamma>.distinct subst_gv.simps 4 GCons by meson
     thus ?thesis using GCons by auto    
   qed
 qed
 
 lemma lookup_if1:
   fixes \<Gamma>::\<Gamma>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and  "Some (b,c) = lookup \<Gamma> x"
   shows "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
 using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
   case GNil
   then show ?case by auto
 next
   case (GCons xbc \<Gamma>)
   then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
     using prod_cases3 by blast
   then show ?case using wf_g_unique GCons lookup_in_g xbc
      lookup.simps set_GConsD wfG.cases 
      insertE insert_is_Un toSet.simps wfG_elims by metis
 qed
 
 lemma lookup_if2:
   assumes "wfG P \<B> \<Gamma>" and   "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
   shows "Some (b,c) = lookup \<Gamma> x" 
 using assms proof(induct \<Gamma> rule: \<Gamma>.induct)
   case GNil
   then show ?case by auto
 next
   case (GCons xbc \<Gamma>)
   then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
     using prod_cases3 by blast
   then show ?case proof(cases "x=x'")
     case True
     then show ?thesis using lookup.simps GCons xbc by simp
   next
     case False
     then show ?thesis using lookup.simps GCons xbc toSet.simps Un_iff set_GConsD wfG_cons2 
       by (metis (full_types) Un_iff set_GConsD toSet.simps(2) wfG_cons2)
   qed
 qed
     
 lemma lookup_iff:
   fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
   shows "Some (b,c) = lookup \<Gamma> x \<longleftrightarrow> (x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)"
   using assms lookup_if1 lookup_if2 by meson
 
 lemma wfG_lookup_wf:
   fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma> and b::b and \<B>::\<B>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "Some (b,c) = lookup \<Gamma> x"
   shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b"
 using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x' b' c' \<Gamma>')
   then show ?case proof(cases "x=x'")
     case True
     then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce 
   next
     case False
     then show ?thesis using lookup.simps wfG_elims(2) GCons by fastforce 
   qed
 qed    
 
 lemma wfG_unique:
   fixes \<Gamma>::\<Gamma>
   assumes "wfG B \<Theta> ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "(x1,b1,c1) \<in> toSet ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "x1=x"
   shows "b1 = b \<and> c1 = c"
 proof - 
   have "(x, b, c) \<in> toSet ((x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" by simp
   thus ?thesis using wf_g_unique assms by blast
 qed
 
 lemma wfG_unique_full:
   fixes \<Gamma>::\<Gamma>
   assumes "wfG \<Theta> B (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "(x1,b1,c1) \<in> toSet (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" and "x1=x"
   shows "b1 = b \<and> c1 = c"
 proof - 
   have "(x, b, c) \<in> toSet (\<Gamma>'@(x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" by simp
   thus ?thesis using wf_g_unique assms by blast
 qed
 
 section \<open>Converting between wb forms\<close>
 
 text \<open> We cannot prove wfB properties here for expressions and statements as need some more facts about @{term \<Phi>}
    context which we can prove without this lemma. Trying to cram everything into a single large
    mutually recursive lemma is not a good idea \<close>
 
 lemma wfX_wfY1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s
            and css::branch_list
   shows  wfV_wf: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta>  " and              
          wfC_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta> " and
          wfG_wf :"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"  and
          wfT_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b_of \<tau>" and
          wfTs_wf:"\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta>" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> True" and       
          wfB_wf: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow>   \<turnstile>\<^sub>w\<^sub>f \<Theta>" and      
          wfCE_wf: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> "  and
          wfTD_wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"
 proof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
 
   case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
   hence "(x,b,c) \<in> toSet \<Gamma>" using lookup_iff lookup_in_g by presburger
   hence "b \<in> fst`snd`toSet \<Gamma>" by force
   hence "wfB \<Theta> \<B> b" using wfV_varI using wfG_lookup_wf by auto
   then show ?case using wfV_varI wfV_elims wf_intros by metis
 next
   case (wfV_litI \<Theta> \<B> \<Gamma> l)
   moreover have "wfTh \<Theta>" using wfV_litI by metis
   ultimately  show ?case using   wf_intros base_for_lit.simps l.exhaust by metis
 next
   case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
   then show ?case using wfB_pairI by simp
 next
   case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
   then show ?case using   wf_intros  by metis
 next
   case (wfTI z \<Gamma> \<Theta> \<B> b c)
   then show ?case using wf_intros b_of.simps wfG_cons2 by metis
 qed(auto)
 
 lemma wfX_wfY2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s
            and css::branch_list
   shows 
          wfE_wf: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>  " and
          wfS_wf: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>   " and
          "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " and
          "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " and       
          wfPhi_wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>" and
          wfD_wf:   "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta> " and       
          wfFTQ_wf: "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>  \<and> \<turnstile>\<^sub>w\<^sub>f \<Theta>" and
          wfFT_wf:  "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<turnstile>\<^sub>w\<^sub>f \<Theta>"           
 proof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
   then show ?case using wfD_elims by auto
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   then show ?case using wf_intros by metis
 next
   case (wfD_emptyI \<Theta> \<B> \<Gamma>)
   then show ?case using wfX_wfY1 by auto
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   then have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using wfX_wfY1 by auto
   moreover have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfS_assertI by auto
   moreover have "\<turnstile>\<^sub>w\<^sub>f \<Theta>  \<and>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfS_assertI by auto
   ultimately  show ?case by auto
 qed(auto)
 
 lemmas wfX_wfY=wfX_wfY1 wfX_wfY2
 
 lemma setD_ConsD:
   "ut \<in> setD (ut' #\<^sub>\<Delta> D) = (ut = ut' \<or> ut \<in> setD D)"
 proof(induct D rule: \<Delta>_induct)
   case DNil
   then show ?case by auto
 next
   case (DCons u' t' x2)
   then show ?case using setD.simps by auto
 qed
 
 lemma wfD_wfT:
   fixes \<Delta>::\<Delta> and \<tau>::\<tau>
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>"
   shows "\<forall>(u,\<tau>) \<in> setD \<Delta>. \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"
 using assms proof(induct \<Delta> rule: \<Delta>_induct)
   case DNil
   then show ?case by auto
 next
   case (DCons u' t' x2)
   then show ?case using wfD_elims DCons setD_ConsD
     by (metis case_prodI2 set_ConsD)
 qed
 
 lemma subst_b_lookup_d:
   assumes "u \<notin> fst ` setD \<Delta>"
   shows  "u \<notin> fst ` setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
 using assms proof(induct \<Delta> rule: \<Delta>_induct)
   case DNil
   then show ?case by auto
 next
   case (DCons u' t'  x2) 
   hence "u\<noteq>u'" using DCons by simp
   show ?case using DCons subst_db.simps by simp
 qed
 
 lemma wfG_cons_splitI:
   fixes  \<Phi>::\<Phi> and \<Gamma>::\<Gamma>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom x \<sharp> \<Gamma>" and "wfB \<Theta> \<B> b" and
       "c \<in> { TRUE, FALSE } \<longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and
       "c \<notin> { TRUE, FALSE } \<longrightarrow> \<Theta>  ;\<B> ;  (x,b,C_true)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
     shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
   using wfG_cons1I wfG_cons2I assms by metis
 
 lemma wfG_consI:
   fixes  \<Phi>::\<Phi> and \<Gamma>::\<Gamma> and c::c
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom x \<sharp> \<Gamma>" and "wfB \<Theta> \<B> b" and
    "\<Theta>  ; \<B> ; (x,b,C_true)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
   shows "\<Theta>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
   using wfG_cons1I wfG_cons2I wfG_cons_splitI wfC_trueI assms by metis
 
 lemma wfG_elim2:
   fixes c::c
   assumes  "wfG P \<B>  ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)" 
   shows "P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<and> wfB P \<B> b" 
 proof(cases "c \<in> {TRUE,FALSE}")
   case True
   have "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<and> atom x \<sharp> \<Gamma> \<and> wfB P \<B> b"  using wfG_elims(2)[OF assms] by auto
   hence "P; \<B> \<turnstile>\<^sub>w\<^sub>f ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) \<and> wfB P \<B> b" using wfG_cons2I by auto
   thus ?thesis using wfC_trueI wfC_falseI True by auto
 next
   case False
   then show ?thesis using wfG_elims(2)[OF assms] by auto
 qed
 
 lemma wfG_cons_wfC:
   fixes \<Gamma>::\<Gamma> and c::c
   assumes "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f (x, b, c)   #\<^sub>\<Gamma> \<Gamma>"
   shows "\<Theta> ; B ; ((x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f c"
   using assms wfG_elim2 by auto
 
 lemma wfG_wfB:
   assumes "wfG P \<B> \<Gamma>" and "b \<in> fst`snd`toSet \<Gamma>"
   shows "wfB P \<B> b"
 using assms proof(induct \<Gamma> rule:\<Gamma>_induct)
 case GNil
   then show ?case by auto
 next
   case (GCons x' b' c' \<Gamma>')
   show ?case proof(cases "b=b'")
     case True
     then show ?thesis using wfG_elim2  GCons by auto
   next
     case False
     hence "b \<in> fst`snd`toSet \<Gamma>'" using GCons by auto
     moreover have "wfG P \<B> \<Gamma>'" using wfG_cons GCons by auto
     ultimately show ?thesis using GCons by auto
   qed
 qed
 
 lemma wfG_cons_TRUE:
   fixes \<Gamma>::\<Gamma> and b::b
   assumes "P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom z \<sharp> \<Gamma>" and "P; \<B> \<turnstile>\<^sub>w\<^sub>f b"
   shows "P  ; \<B> \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>" 
   using wfG_cons2I wfG_wfB assms by simp
 
 lemma wfG_cons_TRUE2:
   assumes "P; \<B> \<turnstile>\<^sub>w\<^sub>f (z,b,c)  #\<^sub>\<Gamma>\<Gamma>" and "atom z \<sharp> \<Gamma>"
   shows "P; \<B> \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>" 
   using  wfG_cons wfG_cons2I assms by simp
 
 lemma wfG_suffix:
   fixes \<Gamma>::\<Gamma>
   assumes "wfG P \<B> (\<Gamma>'@\<Gamma>)"
   shows "wfG P \<B> \<Gamma>"
 using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x b c \<Gamma>')
   hence " P; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ \<Gamma>" using wfG_elims by auto
   then show ?case using GCons  wfG_elims by auto
 qed
 
 lemma wfV_wfCE:
   fixes v::v
   assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" 
   shows " \<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val v : b"
 proof -
   have  "\<Theta> \<turnstile>\<^sub>w\<^sub>f ([]::\<Phi>) "  using wfPhi_emptyI wfV_wf wfG_wf assms by metis
   moreover have "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f []\<^sub>\<Delta>" using wfD_emptyI wfV_wf wfG_wf assms by metis
   ultimately show ?thesis using wfCE_valI assms by auto
 qed
   
 section \<open>Support\<close>
 
 lemma wf_supp1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list
 
   shows  wfV_supp: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and       
          wfC_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> supp c \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and
          wfG_supp: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>  atom_dom \<Gamma> \<subseteq> supp \<Gamma>" and
          wfT_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  supp \<tau> \<subseteq> atom_dom \<Gamma> \<union> supp \<B> " and
          wfTs_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  supp ts \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" and 
          wfTh_supp: "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> supp \<Theta> = {}" and       
          wfB_supp: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> supp b \<subseteq> supp \<B>" and      
          wfCE_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> supp ce \<subseteq>  atom_dom \<Gamma> \<union> supp \<B>" and
          wfTD_supp: "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> supp td \<subseteq>  {}" 
 proof(induct    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
   case (wfB_consI \<Theta> s dclist \<B>)
   then show ?case by(auto simp add: b.supp pure_supp)
 next
   case (wfB_appI \<Theta> \<B> b s bv dclist)
   then show ?case by(auto simp add: b.supp pure_supp)
 next
   case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
   then show ?case using v.supp wfV_elims  
      empty_subsetI insert_subset supp_at_base 
      fresh_dom_free2 lookup_if1 
     by (metis sup.coboundedI1)
 next
   case (wfV_litI \<Theta> \<B> \<Gamma> l)
   then show ?case using supp_l_empty v.supp by simp
 next
   case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
    then show ?case using v.supp wfV_elims  by (metis Un_subset_iff)
 next
   case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
   then show ?case using v.supp wfV_elims  
     Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp by metis
 next
   case (wfV_conspI typid bv dclist \<Theta> dc x b' c \<B> \<Gamma> v b)
   then show ?case  unfolding v.supp 
     using wfV_elims  
     Un_commute b.supp sup_bot.right_neutral supp_b_empty pure_supp 
     by (simp add: Un_commute pure_supp sup.coboundedI1)
 next
   case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
   hence "supp e1 \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using   c.supp wfC_elims 
     image_empty list.set(1) sup_bot.right_neutral  by (metis IntI UnE empty_iff subsetCE subsetI)
   moreover have "supp e2 \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using   c.supp wfC_elims 
     image_empty list.set(1) sup_bot.right_neutral IntI UnE empty_iff subsetCE subsetI
     by (metis wfC_eqI.hyps(4))
   ultimately show ?case using c.supp by auto
 next
   case (wfG_cons1I c \<Theta> \<B> \<Gamma> x b)
   then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis
 next
   case (wfG_cons2I c \<Theta> \<B> \<Gamma> x b)
   then show ?case using atom_dom.simps  dom_supp_g supp_GCons by metis
 next
   case wfTh_emptyI
   then show ?case  by (simp add: supp_Nil)
 next
   case (wfTh_consI \<Theta> lst)
   then show ?case using supp_Cons by fast
 next
   case (wfTD_simpleI \<Theta> lst s)
   then have "supp (AF_typedef s lst ) = supp lst \<union> supp s" using type_def.supp  by auto
   then show ?case using wfTD_simpleI pure_supp 
     by (simp add: pure_supp supp_Cons supp_at_base)
 next
   case (wfTD_poly \<Theta> bv lst s)
   then have "supp (AF_typedef_poly s bv lst ) = supp lst - { atom bv } \<union> supp s" using type_def.supp  by auto
   then show ?case using wfTD_poly pure_supp 
     by (simp add: pure_supp supp_Cons supp_at_base)
 next
   case (wfTs_nil \<Theta> \<B> \<Gamma>)
   then show ?case using supp_Nil by auto
 next
   case (wfTs_cons \<Theta> \<B> \<Gamma> \<tau> dc ts)
   then show ?case using supp_Cons supp_Pair pure_supp[of dc] by blast
 next
   case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
   thus ?case using ce.supp wfCE_elims by simp
 next
   case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
   hence "supp (CE_op Plus v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
     by (simp add: wfCE_plusI opp.supp)  
   then show ?case using  ce.supp wfCE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
 next
   case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
   hence "supp (CE_op LEq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
     by (simp add: wfCE_plusI opp.supp)  
   then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
 next
   case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2 )
   hence "supp (CE_op Eq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using ce.supp pure_supp 
     by (simp add: wfCE_eqI opp.supp)  
   then show ?case using  ce.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by auto
 next
   case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
   thus ?case using ce.supp wfCE_elims by simp
 next
   case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
  thus ?case using ce.supp wfCE_elims by simp
 next
   case (wfCE_concatI \<Theta>  \<B> \<Gamma> v1 v2)
   thus ?case using ce.supp wfCE_elims by simp
 next
   case (wfCE_lenI \<Theta>  \<B> \<Gamma>  v1)
   thus ?case using ce.supp wfCE_elims by simp
 next
    case (wfTI z \<Theta> \<B> \<Gamma> b c)
   hence "supp c \<subseteq> supp z \<union> atom_dom \<Gamma> \<union> supp \<B>" using  supp_at_base dom_cons  by metis
   moreover have "supp b \<subseteq> supp \<B>"  using wfTI by auto
   ultimately have " supp  \<lbrace> z : b  | c \<rbrace> \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using \<tau>.supp supp_at_base by force
   thus ?case by auto
 qed(auto)
 
 lemma wf_supp2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and 
         ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and 
         ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css ::branch_list
   shows
          wfE_supp: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> (supp e \<subseteq>  atom_dom \<Gamma> \<union> supp \<B> \<union> atom ` fst ` setD \<Delta>)" and (* \<and> ( \<Phi> = [] \<longrightarrow> supp e \<inter> supp \<B> = {})" and*)
          wfS_supp: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> supp s \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  supp cs \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  supp css \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" and      
          wfPhi_supp: "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow>  supp \<Phi> = {}" and
          wfD_supp: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> supp \<Delta> \<subseteq> atom`fst`(setD \<Delta>) \<union> atom_dom \<Gamma> \<union> supp \<B> " and      
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> supp ftq = {}" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> supp ft \<subseteq> supp \<B>"      
 proof(induct    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
   case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   hence "supp (AE_val v) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp wf_supp1 by simp
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   hence "supp (AE_op Plus v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  
     using  wfE_plusI opp.supp wf_supp1 e.supp pure_supp Un_least 
     by (metis sup_bot.left_neutral)
 
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   hence "supp (AE_op LEq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp Un_least 
     sup_bot.left_neutral  using opp.supp wf_supp1 by auto
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   hence "supp (AE_op Eq v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp Un_least 
     sup_bot.left_neutral  using opp.supp wf_supp1 by auto
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
  hence "supp (AE_fst  v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
  hence "supp (AE_snd  v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp     wfE_plusI opp.supp wf_supp1  by (metis Un_least)
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   hence "supp (AE_concat v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
     wfE_plusI opp.supp wf_supp1  by (metis Un_least)
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   hence "supp (AE_split v1 v2) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
     wfE_plusI opp.supp wf_supp1  by (metis Un_least)
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   hence "supp (AE_len v1 ) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using e.supp pure_supp 
     using e.supp pure_supp   sup_bot.left_neutral  using opp.supp wf_supp1 by auto
   then show ?case using  e.supp wfE_elims UnCI subsetCE subsetI x_not_in_b_set by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
   then obtain b where "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" using wfE_elims by metis          
   hence  "supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"  using wfE_appI wf_supp1 by metis
   hence "supp (AE_app f v) \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" using e.supp pure_supp by fast
   then show ?case using  e.supp(2)  UnCI subsetCE subsetI wfE_appI  using b.supp(3) pure_supp x_not_in_b_set by metis
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f xa ba ca s)
   then obtain b where "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : ( b[bv::=b']\<^sub>b)" using wfE_elims by metis          
   hence  "supp v \<subseteq> atom_dom \<Gamma> \<union> supp \<B> "  using wfE_appPI wf_supp1 by auto
   moreover have "supp b' \<subseteq> supp  \<B>" using wf_supp1(7) wfE_appPI by simp
   ultimately show ?case unfolding  e.supp using  wfE_appPI pure_supp by fast
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
      then  obtain \<tau> where "(u,\<tau>) \<in> setD \<Delta>" using wfE_elims(10) by metis
   hence "atom u \<in> atom`fst`setD \<Delta>" by force
   hence "supp (AE_mvar u ) \<subseteq> atom`fst`setD \<Delta>" using e.supp
     by (simp add: supp_at_base)
   thus ?case using UnCI subsetCE subsetI e.supp wfE_mvarI supp_at_base subsetCE supp_at_base u_not_in_b_set 
     by (simp add: supp_at_base)
 next
   case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
   then show ?case using wf_supp1 
     by (metis s_branch_s_branch_list.supp(1) sup.coboundedI2 sup_assoc sup_commute) 
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   then show ?case  by auto
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   then show ?case unfolding  s_branch_s_branch_list.supp (3) using wf_supp1(4)[OF wfS_let2I(3)] by auto
 next
   case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
   then show ?case  using wf_supp1(1)[OF wfS_ifI(1)]  by auto
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
   then show ?case  using  wf_supp1(1)[OF wfS_varI(2)]  wf_supp1(4)[OF wfS_varI(1)]  by auto
 next
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   hence "supp u \<subseteq> atom ` fst ` setD \<Delta>" proof(induct \<Delta> rule:\<Delta>_induct)
     case DNil
     then show ?case by auto
   next
     case (DCons u' t' \<Delta>')
     show ?case proof(cases "u=u'")
       case True
       then show ?thesis using toSet.simps DCons supp_at_base by fastforce
     next
       case False
       then show ?thesis  using toSet.simps DCons supp_at_base wfS_assignI 
         by (metis empty_subsetI fstI image_eqI insert_subset)
     qed
   qed
   then show ?case using s_branch_s_branch_list.supp(8) wfS_assignI wf_supp1(1)[OF wfS_assignI(6)] by auto
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   then show ?case using wf_supp1(1)[OF wfS_matchI(1)] by auto
 next
  case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   moreover have "supp s \<subseteq> supp x \<union> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" 
     using dom_cons supp_at_base wfS_branchI by auto
   moreover hence "supp s - set [atom x] \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using supp_at_base by force
   ultimately have
      "(supp s - set [atom x]) \<union> (supp dc ) \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>"
      by (simp add: pure_supp)
   thus ?case using s_branch_s_branch_list.supp(2) by auto
 next
   case (wfD_emptyI \<Theta> \<B> \<Gamma>)
   then show ?case using supp_DNil by auto
 next
   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   have "supp ((u, \<tau>)  #\<^sub>\<Delta> \<Delta>) = supp u \<union> supp \<tau> \<union> supp \<Delta>" using supp_DCons supp_Pair by metis
   also have "... \<subseteq>  supp u \<union> atom ` fst ` setD \<Delta> \<union> atom_dom \<Gamma> \<union> supp \<B>" 
     using wfD_cons wf_supp1(4)[OF wfD_cons(3)] by auto
   also have "... \<subseteq> atom ` fst ` setD ((u, \<tau>)  #\<^sub>\<Delta> \<Delta>) \<union> atom_dom \<Gamma> \<union> supp \<B>" using supp_at_base by auto
   finally show ?case by auto
 next
   case (wfPhi_emptyI \<Theta>)
   then show ?case using supp_Nil by auto
 next
   case (wfPhi_consI f \<Theta> \<Phi> ft)
   then show ?case using fun_def.supp
     by (simp add: pure_supp supp_Cons)
 next
   case (wfFTI \<Theta> B' b s x c \<tau> \<Phi>)
   have " supp (AF_fun_typ x b c \<tau> s) = supp c \<union> (supp \<tau> \<union> supp s) - set [atom x] \<union> supp b" using fun_typ.supp by auto
   thus ?case using wfFTI wf_supp1 
   proof -
     have f1: "supp \<tau> \<subseteq> {atom x} \<union> atom_dom GNil \<union> supp B'"
       using dom_cons wfFTI.hyps wf_supp1(4) by blast (* 0.0 ms *)
     have "supp b \<subseteq> supp B'"
       using wfFTI.hyps(1) wf_supp1(7) by blast (* 0.0 ms *)
     then show ?thesis
       using f1 \<open>supp (AF_fun_typ x b c \<tau> s) = supp c \<union> (supp \<tau> \<union> supp s) - set [atom x] \<union> supp b\<close> 
              wfFTI.hyps(4) wfFTI.hyps by auto (* 234 ms *)
   qed 
 next
   case (wfFTNone \<Theta> \<Phi> ft)
   then show ?case by (simp add: fun_typ_q.supp(2))
 next
   case (wfFTSome \<Theta> \<Phi> bv ft)
   then show ?case using fun_typ_q.supp
     by (simp add: supp_at_base)
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   then have "supp c \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using wf_supp1 
     by (metis Un_assoc Un_commute le_supI2)
   moreover have "supp s  \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" proof 
     fix z
     assume *:"z \<in> supp s"
     have **:"atom x \<notin> supp s" using wfS_assertI fresh_prodN fresh_def by metis
     have "z \<in> atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using wfS_assertI * by blast
     have "z \<in>  atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> z \<in> atom_dom \<Gamma>" using * ** by auto 
     thus  "z \<in> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>" using * ** 
       using \<open>z \<in> atom_dom ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>) \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>\<close> by blast
   qed 
   ultimately show ?case by auto
 qed(auto)
 
 lemmas wf_supp = wf_supp1 wf_supp2
 
 lemma wfV_supp_nil:
   fixes v::v
   assumes "P ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f v : b" 
   shows "supp v = {}"
   using wfV_supp[of P " {||}"  GNil v b] dom.simps toSet.simps
   using assms by auto
 
 lemma wfT_TRUE_aux:
   assumes "wfG P \<B> \<Gamma>" and "atom z \<sharp> (P, \<B>, \<Gamma>)" and "wfB P \<B> b"
   shows "wfT P \<B> \<Gamma> (\<lbrace> z : b  | TRUE \<rbrace>)"  
 proof (rule)
   show \<open> atom z \<sharp> (P, \<B>, \<Gamma>)\<close> using assms by auto
   show \<open> P; \<B> \<turnstile>\<^sub>w\<^sub>f b \<close> using assms by auto
   show \<open> P ;\<B> ;  (z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f TRUE \<close> using wfG_cons2I wfC_trueI assms by auto
 qed
 
 lemma wfT_TRUE:
   assumes "wfG P \<B> \<Gamma>" and "wfB P \<B> b"
   shows "wfT P \<B> \<Gamma> (\<lbrace> z : b  | TRUE \<rbrace>)" 
 proof -
   obtain z'::x where *:"atom z' \<sharp> (P, \<B>, \<Gamma>)" using obtain_fresh by metis
   hence "\<lbrace> z : b  | TRUE \<rbrace> = \<lbrace> z' : b  | TRUE \<rbrace>" by auto
   thus ?thesis using wfT_TRUE_aux assms * by metis
 qed
 
 lemma phi_flip_eq:
   assumes "wfPhi T P"
   shows  "(x \<leftrightarrow> xa) \<bullet> P = P"
   using wfPhi_supp[OF assms] flip_fresh_fresh fresh_def by blast
 
 lemma wfC_supp_cons:
   fixes c'::c and G::\<Gamma>
   assumes "P; \<B> ; (x', b' , TRUE)  #\<^sub>\<Gamma>G \<turnstile>\<^sub>w\<^sub>f c'" 
   shows "supp c' \<subseteq> atom_dom G \<union> supp x' \<union> supp \<B>" and "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>"
 proof -
   show "supp c' \<subseteq> atom_dom G \<union> supp x' \<union> supp \<B>"
     using  wfC_supp[OF assms] dom_cons supp_at_base by blast
   moreover have "atom_dom G \<subseteq> supp G"
     by (meson assms wfC_wf wfG_cons wfG_supp)
   ultimately show "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>" using wfG_supp assms wfG_cons wfC_wf by fast
 qed
 
 lemma wfG_dom_supp:
   fixes x::x
   assumes "wfG P \<B> G"
   shows "atom x \<in> atom_dom G \<longleftrightarrow> atom x \<in> supp G"
 using assms proof(induct G rule: \<Gamma>_induct)
   case GNil
   then show ?case using dom.simps  supp_of_atom_list
     using supp_GNil by auto
 next
   case (GCons x' b' c' G)
 
   show ?case proof(cases "x' = x")
     case True
     then show ?thesis using dom.simps supp_of_atom_list supp_at_base 
       using supp_GCons by auto
   next
     case False
     have "(atom x \<in> atom_dom ((x', b', c')   #\<^sub>\<Gamma> G)) = (atom x \<in> atom_dom G)" using atom_dom.simps False by simp
     also have "... = (atom x \<in> supp  G)" using GCons wfG_elims by metis
     also have "... = (atom x \<in> (supp (x', b', c') \<union> supp G))" proof
       show "atom x \<in> supp G \<Longrightarrow> atom x \<in> supp (x', b', c') \<union> supp G" by auto
       assume "atom x \<in> supp (x', b', c') \<union> supp G"
       then consider "atom x \<in> supp (x', b', c')" | "atom x \<in> supp G" by auto
       then show "atom x \<in> supp G" proof(cases)
         case 1
         assume " atom x \<in> supp (x', b', c') "
         hence "atom x \<in>  supp c'" using supp_triple False supp_b_empty supp_at_base by force
 
         moreover have "P; \<B> ; (x', b' , TRUE)  #\<^sub>\<Gamma>G \<turnstile>\<^sub>w\<^sub>f c'" using wfG_elim2 GCons by simp
         moreover hence "supp c' \<subseteq> supp G \<union> supp x' \<union> supp \<B>" using wfC_supp_cons by auto
         ultimately have  "atom x \<in> supp G \<union> supp x' "   using x_not_in_b_set by auto
         then show ?thesis using False supp_at_base  by (simp add: supp_at_base)
       next
         case 2
         then show ?thesis by simp
       qed
     qed
     also have "... = (atom x \<in> supp ((x', b', c')   #\<^sub>\<Gamma> G))"  using supp_at_base False supp_GCons by simp
     finally show ?thesis by simp
   qed
 qed
 
 lemma wfG_atoms_supp_eq : 
   fixes x::x
   assumes "wfG P \<B> G"
   shows "atom x \<in> atom_dom G \<longleftrightarrow> atom x \<in> supp G"
   using wfG_dom_supp assms by auto
 
 lemma beta_flip_eq:
   fixes x::x and xa::x and \<B>::\<B>
   shows  "(x \<leftrightarrow> xa) \<bullet> \<B> = \<B>"
 proof - 
   have "atom x \<sharp> \<B> \<and> atom xa \<sharp> \<B>" using x_not_in_b_set fresh_def supp_set by metis
   thus ?thesis  by (simp add: flip_fresh_fresh fresh_def)
 qed
 
 lemma theta_flip_eq2:
   assumes "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows  " (z \<leftrightarrow> za ) \<bullet> \<Theta> = \<Theta>"
 proof -
   have "supp \<Theta> = {}" using wfTh_supp assms by simp
   thus ?thesis 
       by (simp add: flip_fresh_fresh fresh_def)
   qed
 
 lemma theta_flip_eq:
   assumes "wfTh \<Theta>"
   shows  "(x \<leftrightarrow> xa) \<bullet> \<Theta> = \<Theta>"
   using wfTh_supp flip_fresh_fresh fresh_def 
   by (simp add: assms theta_flip_eq2)
 
 lemma wfT_wfC:
   fixes c::c 
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom z \<sharp> \<Gamma>"
   shows "\<Theta>; \<B>; (z,b,TRUE)  #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c"
 proof -
   obtain za ba ca where *:"\<lbrace> z : b  | c \<rbrace> = \<lbrace> za : ba  | ca \<rbrace> \<and> atom za \<sharp> (\<Theta>,\<B>,\<Gamma>) \<and>  \<Theta>; \<B>; (za, ba, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ca"
     using wfT_elims[OF assms(1)] by metis
   hence c1: "[[atom z]]lst. c = [[atom za]]lst. ca" using \<tau>.eq_iff by meson
   show ?thesis proof(cases "z=za")
     case True
     hence "ca = c" using  c1  by (simp add: Abs1_eq_iff(3))
     then show ?thesis using * True by simp
   next
     case False
     have " \<turnstile>\<^sub>w\<^sub>f \<Theta>" using wfT_wf wfG_wf assms by metis
     moreover have "atom za \<sharp> \<Gamma>" using * fresh_prodN by auto
     ultimately have  "\<Theta>; \<B>; (z \<leftrightarrow> za ) \<bullet> (za, ba, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f (z \<leftrightarrow> za ) \<bullet> ca" 
       using wfC.eqvt theta_flip_eq2  beta_flip_eq * GCons_eqvt assms flip_fresh_fresh  by metis
     moreover have "atom z \<sharp> ca"     
     proof -
       have "supp ca \<subseteq> atom_dom \<Gamma> \<union> { atom za } \<union> supp \<B>" using  * wfC_supp atom_dom.simps toSet.simps by fastforce
       moreover have "atom z \<notin> atom_dom \<Gamma> " using assms fresh_def wfT_wf  wfG_dom_supp wfC_supp by metis
       moreover hence  "atom z \<notin> atom_dom \<Gamma> \<union> { atom za }" using False by simp
       moreover have "atom z \<notin> supp \<B>" using x_not_in_b_set by simp
       ultimately show ?thesis using fresh_def False by fast
     qed
     moreover hence  "(z \<leftrightarrow> za ) \<bullet> ca = c" using type_eq_subst_eq1(3)  * by metis 
     ultimately show  ?thesis using assms G_cons_flip_fresh * by auto
   qed
 qed
 
 lemma u_not_in_dom_g:
   fixes u::u
   shows  "atom u \<notin> atom_dom  G"
   using toSet.simps atom_dom.simps u_not_in_x_atoms by auto
 
 lemma bv_not_in_dom_g:
   fixes bv::bv
   shows  "atom bv \<notin> atom_dom  G"
   using toSet.simps atom_dom.simps u_not_in_x_atoms by auto
   
 text \<open>An important lemma that confirms that @{term \<Gamma>} does not rely on mutable variables\<close>
 lemma u_not_in_g:
   fixes u::u
   assumes "wfG \<Theta> B G"
   shows  "atom u \<notin> supp G"
 using assms proof(induct G rule: \<Gamma>_induct)
 case GNil
   then show ?case using supp_GNil fresh_def 
     using fresh_set_empty by fastforce
 next
   case (GCons x b c \<Gamma>')
    moreover hence "atom u \<notin> supp b"  using 
     wfB_supp wfC_supp u_not_in_x_atoms wfG_elims wfX_wfY by auto
    moreover hence "atom u \<notin> supp x"  using u_not_in_x_atoms supp_at_base by blast
    moreover hence "atom u \<notin> supp c" proof -
      have "\<Theta> ; B ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c" using wfG_cons_wfC GCons by simp
      hence "supp c \<subseteq> atom_dom ((x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>') \<union> supp B" using wfC_supp by blast
      thus ?thesis using u_not_in_dom_g u_not_in_b_atoms 
        using u_not_in_b_set by auto
    qed
    ultimately have "atom u \<notin> supp (x,b,c)" using supp_Pair by simp
    thus  ?case using supp_GCons GCons wfG_elims by blast
 qed
 
 text \<open>An important lemma that confirms that types only depend on immutable variables\<close>
 lemma u_not_in_t:
   fixes u::u
   assumes "wfT \<Theta> B G \<tau>"
   shows  "atom u \<notin> supp \<tau>"
 proof -
   have "supp \<tau> \<subseteq> atom_dom G \<union> supp B" using  wfT_supp assms by auto
   thus ?thesis using u_not_in_dom_g u_not_in_b_set  by blast 
 qed  
 
 lemma wfT_supp_c:
   fixes \<B>::\<B> and z::x
   assumes "wfT P \<B> \<Gamma> (\<lbrace> z : b  | c \<rbrace>)" 
   shows "supp c - { atom z } \<subseteq> atom_dom \<Gamma> \<union> supp  \<B>"
   using wf_supp \<tau>.supp assms 
   by (metis Un_subset_iff empty_set list.simps(15)) 
 
 lemma wfG_wfC[ms_wb]:
   assumes "wfG P \<B> ((x,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
   shows "wfC P \<B> ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) c"
 using assms proof(cases "c \<in> {TRUE,FALSE}")
   case True
   have "atom x \<sharp> \<Gamma> \<and> wfG P \<B> \<Gamma> \<and> wfB P \<B> b" using wfG_cons assms by auto
   hence "wfG P \<B>  ((x,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>)" using wfG_cons2I by auto
   then show ?thesis using wfC_trueI wfC_falseI True by auto
 next
   case False
   then show ?thesis using wfG_elims assms by blast
 qed
 
 lemma wfT_wf_cons: 
   assumes "wfT P \<B> \<Gamma> \<lbrace> z : b  | c \<rbrace>" and "atom z \<sharp> \<Gamma>"
   shows "wfG P \<B> ((z,b,c)  #\<^sub>\<Gamma>\<Gamma>)"
 using assms proof(cases "c \<in> { TRUE,FALSE }")
   case True
   then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons2I assms wfT_wf by fastforce
 next
   case False
   then show ?thesis using wfT_wfC wfC_wf wfG_wfB  wfG_cons1I wfT_wf wfT_wfC assms by fastforce
 qed
 
 lemma wfV_b_fresh:
   fixes b::b and v::v and bv::bv 
   assumes  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v: b" and "bv |\<notin>| \<B>"
   shows "atom bv \<sharp> v"
 using wfV_supp  bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp by blast
 
 lemma wfCE_b_fresh:
   fixes b::b and ce::ce and bv::bv 
   assumes  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce: b" and "bv |\<notin>| \<B>"
   shows "atom bv \<sharp> ce"
 using bv_not_in_dom_g fresh_def assms bv_not_in_bset_supp wf_supp1(8) by fast
  
 section \<open>Freshness\<close>
 
 lemma wfG_fresh_x:
   fixes \<Gamma>::\<Gamma> and z::x
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and "atom z \<sharp> \<Gamma>" 
   shows "atom z \<sharp> (\<Theta>,\<B>, \<Gamma>)"
 unfolding fresh_prodN apply(intro conjI)
   using wf_supp1 wfX_wfY assms fresh_def x_not_in_b_set by(metis empty_iff)+
 
 lemma wfG_wfT:
   assumes "wfG P \<B> ((x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> G)" and "atom x \<sharp> c"
   shows "P; \<B> ; G \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" 
 proof - 
   have " P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> G  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v \<and> wfB P \<B> b" using  assms 
     using wfG_elim2 by auto
   moreover have "atom x \<sharp>  (P ,\<B>,G)" using wfG_elims assms wfG_fresh_x by metis
   ultimately have  "wfT P \<B> G \<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using wfTI assms by metis
   moreover have "\<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace> = \<lbrace> z : b | c \<rbrace>" using type_eq_subst \<open>atom x \<sharp> c\<close> by auto
   ultimately show  ?thesis by auto
 qed
 
 lemma wfT_wfT_if:
   assumes "wfT \<Theta> \<B> \<Gamma> (\<lbrace> z2 : b  | CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\<^sub>c\<^sub>v  \<rbrace>)" and "atom z2 \<sharp> (c,\<Gamma>)"
   shows "wfT \<Theta> \<B> \<Gamma> \<lbrace> z : b |  c \<rbrace>" 
 proof -
   have *: "atom z2 \<sharp> (\<Theta>, \<B>, \<Gamma>)" using wfG_fresh_x wfX_wfY assms fresh_Pair by metis
   have "wfB \<Theta> \<B>  b" using assms wfT_elims by metis
   have "\<Theta>; \<B>; (GCons (z2,b,TRUE) \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  (CE_val v  ==  CE_val (V_lit L_false) IMP  c[z::=V_var z2]\<^sub>c\<^sub>v)"  using wfT_wfC assms fresh_Pair by auto
   hence "\<Theta>; \<B>; ((z2,b,TRUE)  #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c[z::=V_var z2]\<^sub>c\<^sub>v"  using wfC_elims by metis
   hence "wfT \<Theta> \<B> \<Gamma>  (\<lbrace> z2 : b  | c[z::=V_var z2]\<^sub>c\<^sub>v\<rbrace>)" using assms fresh_Pair wfTI \<open>wfB \<Theta> \<B> b\<close> * by auto
   moreover have "\<lbrace> z : b |  c \<rbrace> = \<lbrace> z2 : b | c[z::=V_var z2]\<^sub>c\<^sub>v \<rbrace>"  using type_eq_subst assms fresh_Pair by auto
   ultimately show ?thesis using wfTI assms by argo
 qed
 
 lemma wfT_fresh_c:
   fixes x::x
   assumes "wfT P \<B> \<Gamma> \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>" and "x \<noteq> z"
   shows "atom x \<sharp> c"
 proof(rule ccontr)
   assume "\<not> atom x \<sharp> c"
   hence *:"atom x \<in> supp c" using fresh_def by auto
   moreover have "supp c - set [atom z] \<union> supp b \<subseteq> atom_dom \<Gamma> \<union> supp \<B>"
     using assms  wfT_supp \<tau>.supp by blast
   moreover hence "atom x \<in> supp c - set [atom z]" using assms  * by auto
   ultimately have "atom x \<in> atom_dom \<Gamma>" using x_not_in_b_set by auto
   thus False using assms wfG_atoms_supp_eq wfT_wf fresh_def by metis
 qed
 
 lemma wfG_x_fresh [simp]: 
   fixes x::x
   assumes "wfG P \<B> G"
   shows "atom x \<notin> atom_dom G \<longleftrightarrow> atom x \<sharp> G"
   using wfG_atoms_supp_eq assms fresh_def  by metis
 
 lemma wfD_x_fresh:
   fixes x::x
   assumes "atom x \<sharp> \<Gamma>" and "wfD P B \<Gamma> \<Delta>"
   shows "atom x \<sharp> \<Delta>"
 using assms proof(induct \<Delta> rule: \<Delta>_induct)
   case DNil
   then show ?case using supp_DNil fresh_def by auto
 next
   case (DCons u' t'  \<Delta>')
   have wfg: "wfG P B \<Gamma>" using wfD_wf DCons by blast
   hence wfd: "wfD P B \<Gamma> \<Delta>'" using wfD_elims DCons by blast
   have "supp t' \<subseteq> atom_dom \<Gamma> \<union> supp B" using wfT_supp DCons wfD_elims  by metis
   moreover have "atom x \<notin> atom_dom \<Gamma>" using DCons(2) fresh_def wfG_supp wfg by blast
   ultimately have  "atom x \<sharp> t'" using fresh_def DCons wfG_supp wfg x_not_in_b_set by blast
   moreover have "atom x \<sharp> u'" using supp_at_base fresh_def by fastforce
   ultimately have "atom x \<sharp> (u',t')" using supp_Pair by fastforce
   thus ?case using DCons fresh_DCons wfd by fast
 qed
 
 lemma wfG_fresh_x2:
   fixes \<Gamma>::\<Gamma> and z::x and \<Delta>::\<Delta> and \<Phi>::\<Phi>
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" and "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "atom z \<sharp> \<Gamma>" 
   shows "atom z \<sharp> (\<Theta>,\<Phi>,\<B>, \<Gamma>,\<Delta>)"
   unfolding fresh_prodN apply(intro conjI)
   using wfG_fresh_x assms fresh_prod3 wfX_wfY apply metis
   using wf_supp2(5)  assms fresh_def apply blast
   using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis
   using assms wfG_fresh_x wfX_wfY fresh_prod3 apply metis
   using wf_supp2(6)  assms fresh_def wfD_x_fresh by metis
 
 lemma wfV_x_fresh:
   fixes v::v and b::b and \<Gamma>::\<Gamma> and x::x
   assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" and "atom x \<sharp> \<Gamma>"
   shows "atom x \<sharp> v"
 proof -
   have "supp v \<subseteq> atom_dom \<Gamma> \<union> supp  \<B> " using assms wfV_supp by auto
   moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
      dom.simps subsetCE  wfG_elims wfG_supp  by (metis dom_supp_g)
   moreover have "atom x \<notin> supp \<B>" using x_not_in_b_set by auto
   ultimately show ?thesis using fresh_def by fast
 qed
 
 lemma wfE_x_fresh:
   fixes e::e and b::b and \<Gamma>::\<Gamma> and \<Delta>::\<Delta> and \<Phi>::\<Phi>  and x::x
   assumes "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and "atom x \<sharp> \<Gamma>"
   shows "atom x \<sharp> e"
 proof -
   have "wfG \<Theta> \<B> \<Gamma>" using assms wfE_wf by auto
   hence "supp e \<subseteq> atom_dom \<Gamma> \<union> supp \<B> \<union> atom`fst`setD \<Delta>" using wfE_supp dom.simps assms by auto
   moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
      dom.simps subsetCE  \<open>wfG \<Theta> \<B> \<Gamma>\<close>  wfG_supp  by (metis dom_supp_g)
   moreover have "atom x \<notin> atom`fst`setD \<Delta>" by auto
   ultimately show ?thesis using fresh_def x_not_in_b_set by fast 
 qed
 
 lemma wfT_x_fresh:
   fixes \<tau>::\<tau> and \<Gamma>::\<Gamma> and  x::x
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" and "atom x \<sharp> \<Gamma>"
   shows "atom x \<sharp> \<tau>"
 proof -
   have "wfG \<Theta> \<B> \<Gamma>" using assms wfX_wfY by auto
   hence "supp \<tau> \<subseteq> atom_dom \<Gamma> \<union> supp \<B>" using wfT_supp dom.simps assms by auto
   moreover have "atom x \<notin> atom_dom \<Gamma>" using fresh_def assms
      dom.simps subsetCE  \<open>wfG \<Theta> \<B> \<Gamma>\<close>  wfG_supp  by (metis dom_supp_g)
   moreover have "atom x \<notin> supp \<B>" using x_not_in_b_set by simp
   ultimately show ?thesis using fresh_def by fast 
 qed
 
 lemma wfS_x_fresh:
   fixes s::s  and \<Delta>::\<Delta> and x::x
   assumes "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>  \<turnstile>\<^sub>w\<^sub>f s : b" and "atom x \<sharp> \<Gamma>"
   shows "atom x \<sharp> s"
 proof - 
   have "supp s \<subseteq> atom_dom \<Gamma> \<union> atom ` fst ` setD \<Delta> \<union> supp \<B>"  using  wf_supp assms by metis
   moreover have "atom x \<notin> atom ` fst ` setD \<Delta>" by auto
   moreover have "atom x \<notin> atom_dom \<Gamma>" using assms fresh_def wfG_dom_supp wfX_wfY by metis
   moreover have "atom x \<notin> supp \<B>" using supp_b_empty supp_fset 
     by (simp add: x_not_in_b_set)
   ultimately show ?thesis using fresh_def by fast 
 qed
 
 lemma wfTh_fresh:
   fixes x
   assumes "wfTh T"
   shows "atom x \<sharp> T"
   using wf_supp1 assms fresh_def by fastforce
 
 lemmas wfTh_x_fresh = wfTh_fresh
 
 lemma wfPhi_fresh:
   fixes x
   assumes "wfPhi T P"
   shows "atom x \<sharp> P"
   using wf_supp assms fresh_def by fastforce
 
 lemmas wfPhi_x_fresh = wfPhi_fresh
 lemmas wb_x_fresh = wfTh_x_fresh wfPhi_x_fresh wfD_x_fresh wfT_x_fresh wfV_x_fresh
 
 lemma wfG_inside_fresh[ms_fresh]:
   fixes \<Gamma>::\<Gamma> and x::x
   assumes "wfG P \<B> (\<Gamma>'@((x,b,c)  #\<^sub>\<Gamma>\<Gamma>))"
   shows "atom x \<notin> atom_dom \<Gamma>'"
 using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x1 b1 c1 \<Gamma>1)
   moreover hence "atom x \<notin> atom ` fst `({(x1,b1,c1)})" proof -
     have *: "P; \<B>  \<turnstile>\<^sub>w\<^sub>f (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using wfG_elims append_g.simps GCons by metis
     have "atom x1 \<sharp>  (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using GCons wfG_elims append_g.simps by metis
     hence "atom x1 \<notin> atom_dom  (\<Gamma>1 @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using wfG_dom_supp fresh_def * by metis
     thus ?thesis by auto
   qed
   ultimately show ?case using append_g.simps atom_dom.simps toSet.simps wfG_elims dom.simps
     by (metis image_insert insert_iff insert_is_Un)
 qed
 
 lemma wfG_inside_x_in_atom_dom:
   fixes c::c and x::x  and \<Gamma>::\<Gamma> 
   shows "atom x \<in> atom_dom ( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)"
   by(induct \<Gamma>'  rule: \<Gamma>_induct, (simp add: toSet.simps atom_dom.simps)+)
 
 lemma wfG_inside_x_neq:
   fixes c::c and x::x  and \<Gamma>::\<Gamma> and G::\<Gamma> and xa::x
   assumes "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G"
   shows "xa \<noteq> x"
 proof - 
   have "atom xa \<notin> atom_dom G"  using fresh_def wfG_atoms_supp_eq assms by metis
   moreover have "atom x \<in> atom_dom G" using wfG_inside_x_in_atom_dom assms by simp
   ultimately show ?thesis by auto
 qed
 
 lemma wfG_inside_x_fresh:
   fixes c::c and x::x  and \<Gamma>::\<Gamma> and G::\<Gamma> and xa::x
   assumes "G=( \<Gamma>'@ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>)" and "atom xa \<sharp> G" and " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G"
   shows "atom xa \<sharp> x"
   using fresh_def supp_at_base wfG_inside_x_neq assms by auto
 
 lemma wfT_nil_supp:
   fixes t::\<tau>
   assumes "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f t" 
   shows "supp t = {}"
   using wfT_supp atom_dom.simps assms toSet.simps by force
 
 section \<open>Misc\<close>
 
 lemma wfG_cons_append:
   fixes b'::b
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b', c')   #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>"
   shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)  \<and> atom x' \<sharp> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>) \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b' \<and> x' \<noteq> x"
 proof - 
   have "((x', b', c')   #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma> = (x', b', c')   #\<^sub>\<Gamma> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)" using append_g.simps by auto
   hence *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)  \<and> atom x' \<sharp> (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>) \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b'" using assms wfG_cons by metis
   moreover have "atom x' \<sharp> x" proof(rule wfG_inside_x_fresh[of "(\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)"])
     show "\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma> = \<Gamma>' @ (x, b, c[x::=V_var x]\<^sub>c\<^sub>v)   #\<^sub>\<Gamma> \<Gamma>" by simp
       show "  atom x' \<sharp> \<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>" using * by auto
       show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>  " using * by auto
     qed
   ultimately show  ?thesis by auto
 qed
 
 lemma flip_u_eq:
   fixes  u::u and u'::u and \<Theta>::\<Theta> and \<tau>::\<tau>
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" 
   shows "(u \<leftrightarrow> u') \<bullet> \<tau> = \<tau>" and  "(u \<leftrightarrow> u') \<bullet> \<Gamma> = \<Gamma>"  and "(u \<leftrightarrow> u') \<bullet> \<Theta> = \<Theta>" and "(u \<leftrightarrow> u') \<bullet> \<B> = \<B>"
 proof -
   show "(u \<leftrightarrow> u') \<bullet> \<tau> = \<tau>" using wfT_supp flip_fresh_fresh
     by (metis assms(1) fresh_def u_not_in_t)
   show "(u \<leftrightarrow> u') \<bullet> \<Gamma> = \<Gamma>" using u_not_in_g wfX_wfY assms flip_fresh_fresh fresh_def by metis
   show  "(u \<leftrightarrow> u') \<bullet> \<Theta> = \<Theta>" using theta_flip_eq assms wfX_wfY by metis
   show  "(u \<leftrightarrow> u') \<bullet> \<B> = \<B>" using u_not_in_b_set flip_fresh_fresh fresh_def by metis
 qed
 
 lemma wfT_wf_cons_flip: 
   fixes c::c and x::x
   assumes "wfT P \<B> \<Gamma> \<lbrace> z : b  | c \<rbrace>" and "atom x \<sharp> (c,\<Gamma>)"
   shows "wfG P \<B> ((x,b,c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma>\<Gamma>)"
 proof -
   have "\<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace> = \<lbrace> z : b  | c \<rbrace>" using assms freshers type_eq_subst by metis
   hence *:"wfT P \<B> \<Gamma>  \<lbrace> x : b | c[z::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms by metis
   show ?thesis proof(rule wfG_consI)
     show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<close> using assms wfT_wf by auto
     show \<open>atom x \<sharp> \<Gamma>\<close> using assms   by auto
     show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using assms wfX_wfY b_of.simps  by metis
     show \<open> P; \<B> ; (x, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c[z::=V_var x]\<^sub>c\<^sub>v \<close> using wfT_wfC * assms fresh_Pair by metis
   qed
 qed
 
 section \<open>Context Strengthening\<close>
 
 text \<open>We can remove an entry for a variable from the context if the variable doesn't appear in the 
 term and the variable is not used later in the context or any other context\<close>
 
 lemma fresh_restrict:
   fixes y::"'a::at_base" and \<Gamma>::\<Gamma>
   assumes  "atom y \<sharp>  (\<Gamma>' @ (x, b, c)   #\<^sub>\<Gamma> \<Gamma>)"
   shows "atom y \<sharp> (\<Gamma>'@\<Gamma>)"
 using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case using fresh_GCons fresh_GNil by auto
 next
   case (GCons x' b' c' \<Gamma>'')
   then show ?case using fresh_GCons fresh_GNil by auto
 qed
 
 lemma wf_restrict1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
         and cs::branch_s and css::branch_list
   shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b        \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> v \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1  \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  v : b" and
        
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> c\<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta> ;  \<B> ; \<Gamma>\<^sub>1@\<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f  c" and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow>  atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>\<^sub>1@\<Gamma>\<^sub>2" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> \<tau>\<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow>  \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and
        
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True" and
         
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c')  #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> ce  \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f  ce : b"  and 
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
 proof(induct   arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
                rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
   case (wfV_varI \<Theta> \<B> \<Gamma> b c y)
   hence "y\<noteq>x" using v.fresh by auto
   hence "Some (b, c) = lookup (\<Gamma>\<^sub>1@\<Gamma>\<^sub>2) y" using lookup_restrict wfV_varI by metis
   then show ?case using wfV_varI wf_intros by metis
 next
   case (wfV_litI \<Theta> \<Gamma> l)
   then show ?case using e.fresh wf_intros by metis
 next
   case (wfV_pairI \<Theta> \<B> \<Gamma> v1 b1 v2 b2)
   show ?case proof
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v1 : b1" using wfV_pairI by auto
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v2 : b2" using wfV_pairI by auto
   qed
 next
   case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
   show ?case proof
     show "AF_typedef s dclist \<in> set \<Theta>" using wfV_consI by auto
     show "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist" using wfV_consI by auto
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b" using wfV_consI by auto
   qed
 next
    case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
     show ?case proof
     show "AF_typedef_poly s bv dclist \<in> set \<Theta>" using wfV_conspI by auto
     show "(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist" using wfV_conspI by auto
     show "\<Theta>; \<B>    \<turnstile>\<^sub>w\<^sub>f  b" using wfV_conspI by auto
     show " \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b" using wfV_conspI by auto
     show "atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2, b, v)" unfolding fresh_prodN fresh_append_g  using wfV_conspI fresh_prodN fresh_GCons fresh_append_g by metis
   qed
 next 
   case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
   then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
    then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
    then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
  then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using ce.fresh wf_intros by metis
 next
   case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
   then show ?case using ce.fresh wf_intros by metis
 next
   case (wfTI z \<Theta> \<B> \<Gamma> b c)
   hence "x \<noteq> z" using wfTI
    fresh_GCons fresh_prodN fresh_PairD(1) fresh_gamma_append not_self_fresh by metis
   show ?case proof
     show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2)\<close> using wfTI fresh_restrict[of z] using wfG_fresh_x wfX_wfY wfTI fresh_prodN by metis
     show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<close> using wfTI by auto
     have "\<Theta>; \<B>; ((z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c " proof(rule  wfTI(5)[of "(z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma>\<^sub>1" ])
       show \<open>(z, b, TRUE)   #\<^sub>\<Gamma> \<Gamma> = ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2\<close> using wfTI by auto
       show \<open>atom x \<sharp> c\<close> using wfTI \<tau>.fresh \<open>x \<noteq> z\<close> by auto
       show \<open>atom x \<sharp> (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1\<close> using wfTI \<open>x \<noteq> z\<close> fresh_GCons by simp
     qed
     thus  \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c \<close>  by auto
   qed
 next
   case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
   show ?case proof
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f e1 : b " using wfC_eqI c.fresh fresh_Nil by auto
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f e2 : b " using wfC_eqI c.fresh fresh_Nil by auto
   qed
 next
   case (wfC_trueI \<Theta> \<Gamma>)
   then show ?case using c.fresh wf_intros by metis
 next
   case (wfC_falseI \<Theta> \<Gamma>)
   then show ?case using c.fresh wf_intros by metis
 next
   case (wfC_conjI \<Theta> \<Gamma> c1 c2)
   then show ?case using c.fresh wf_intros by metis
 next
   case (wfC_disjI \<Theta> \<Gamma> c1 c2)
   then show ?case using c.fresh wf_intros by metis
 next
 case (wfC_notI \<Theta> \<Gamma> c1)
   then show ?case using c.fresh wf_intros by metis
 next
   case (wfC_impI \<Theta> \<Gamma> c1 c2)
   then show ?case using c.fresh wf_intros by metis
 next
   case (wfG_nilI \<Theta>)
   then show ?case using wfV_varI wf_intros 
     by (meson GNil_append \<Gamma>.simps(3))
 next
   case (wfG_cons1I c1 \<Theta> \<B> G x1 b1)
   show  ?case proof(cases "\<Gamma>\<^sub>1=GNil")
     case True
     then show ?thesis using wfG_cons1I wfG_consI by auto
   next
     case False
     then obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>\<^sub>1" using  GCons_eq_append_conv wfG_cons1I by auto
     hence **:"G=G' @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons1I by auto
 
     have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> (G' @ \<Gamma>\<^sub>2)" proof(rule Wellformed.wfG_cons1I)
       show \<open>c1 \<notin> {TRUE, FALSE}\<close> using wfG_cons1I by auto
       show \<open>atom x1 \<sharp> G' @ \<Gamma>\<^sub>2\<close> using wfG_cons1I(4) ** fresh_restrict by metis
       have " atom x \<sharp> G'" using wfG_cons1I *  using fresh_GCons by blast
       thus  \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ \<Gamma>\<^sub>2 \<close> using wfG_cons1I(3)[of G'] **  by auto
       have "atom x \<sharp> c1 \<and> atom x \<sharp> (x1, b1, TRUE)  #\<^sub>\<Gamma> G'" using fresh_GCons \<open>atom x \<sharp> \<Gamma>\<^sub>1\<close> * by auto
       thus  \<open> \<Theta>; \<B>; (x1, b1, TRUE)  #\<^sub>\<Gamma> G' @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f c1 \<close> using wfG_cons1I(6)[of "(x1, b1, TRUE)  #\<^sub>\<Gamma> G'"]  ** * wfG_cons1I by auto
       show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfG_cons1I by auto
     qed
     thus ?thesis using * by auto
   qed
 next
   case (wfG_cons2I c1 \<Theta> \<B> G x1 b1)
   show  ?case proof(cases "\<Gamma>\<^sub>1=GNil")
     case True
     then show ?thesis using wfG_cons2I wfG_consI by auto
   next
     case False
     then obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>\<^sub>1" using  GCons_eq_append_conv wfG_cons2I by auto
     hence **:"G=G' @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons2I by auto
 
     have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> (G' @ \<Gamma>\<^sub>2)" proof(rule Wellformed.wfG_cons2I)
       show \<open>c1 \<in> {TRUE, FALSE}\<close> using wfG_cons2I by auto
       show \<open>atom x1 \<sharp> G' @ \<Gamma>\<^sub>2\<close> using wfG_cons2I ** fresh_restrict by metis
       have " atom x \<sharp> G'" using wfG_cons2I *  using fresh_GCons by blast
       thus  \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ \<Gamma>\<^sub>2 \<close> using wfG_cons2I **  by auto     
       show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfG_cons2I by auto
     qed
     thus ?thesis using * by auto
   qed
 qed(auto)+
 
 lemma wf_restrict2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
         and cs::branch_s and css::branch_list
   shows          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> e  \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> atom x \<sharp> \<Delta> \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 ;  \<Delta> \<turnstile>\<^sub>w\<^sub>f  e : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> True" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and     
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> atom x \<sharp> \<Gamma>\<^sub>1 \<Longrightarrow> atom x \<sharp> \<Delta> \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>1@\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and       
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> True" 
     
 proof(induct   arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1  and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
                rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts)
   case (wfE_valI \<Theta> \<Phi> \<Gamma> \<Delta> v b)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_leqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b v2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_lenI \<Theta> \<Phi> \<Gamma> \<Delta> v1)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<Gamma> \<Delta> f x b c \<tau> s' v)
   then show ?case using e.fresh wf_intros wf_restrict1 by metis
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
   show ?case proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfE_appPI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close>  using wfE_appPI by auto
 
     have "atom bv \<sharp>  \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2" using  wfE_appPI fresh_prodN fresh_restrict  by metis
     thus  \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>  
       using wfE_appPI fresh_prodN by auto
 
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close>  using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close>  using wfE_appPI wf_restrict1 by auto
   qed
 next
   case (wfE_mvarI \<Theta> \<Phi> \<Gamma> \<Delta> u \<tau>)
   then show ?case using e.fresh wf_intros by metis
 next
   case (wfD_emptyI \<Theta> \<Gamma>)
   then show ?case using c.fresh wf_intros wf_restrict1 by metis
 next
   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   show ?case proof
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfD_cons fresh_DCons by metis
     show "\<Theta>; \<B>; \<Gamma>\<^sub>1 @ \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfD_cons fresh_DCons fresh_Pair wf_restrict1 by metis
     show "u \<notin> fst ` setD \<Delta>" using wfD_cons by auto
   qed
 next
   case (wfFTNone \<Theta> ft)
   then show ?case by auto
 next
   case (wfFTSome \<Theta> bv ft)
   then show ?case by auto
 next
   case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
   then show ?case by auto
 qed(auto)+
 
 lemmas wf_restrict=wf_restrict1 wf_restrict2
 
 lemma wfT_restrict2:
   fixes \<tau>::\<tau>
   assumes "wfT \<Theta> \<B> ((x, b, c) #\<^sub>\<Gamma> \<Gamma>) \<tau>" and "atom x \<sharp> \<tau>" 
   shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>"
   using wf_restrict1(4)[of \<Theta> \<B> "((x, b, c) #\<^sub>\<Gamma> \<Gamma>)"  \<tau> GNil x "b" "c" \<Gamma>] assms fresh_GNil append_g.simps by auto
 
 lemma wfG_intros2:
   assumes "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c"
   shows  "wfG P \<B>  ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
 proof - 
   have "wfG P \<B>   ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>)" using wfC_wf  assms by auto
   hence *:"wfG P \<B> \<Gamma> \<and> atom x \<sharp> \<Gamma> \<and> wfB P \<B> b" using wfG_elims by metis
   show ?thesis using assms proof(cases "c \<in> {TRUE,FALSE}")
     case True 
     then show ?thesis using wfG_cons2I * by auto
   next
     case False
     then show ?thesis using wfG_cons1I * assms by auto
   qed
 qed
 
 section \<open>Type Definitions\<close>
 
 lemma wf_theta_weakening1: 
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B> :: \<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list and t::\<tau>
 
   shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  c" and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B>   \<turnstile>\<^sub>w\<^sub>f \<Gamma>" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow>  \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ;  \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts" and 
          "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b  \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B>  \<turnstile>\<^sub>w\<^sub>f b"  and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f td"
 proof(nominal_induct b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
       avoiding: \<Theta>'     
       rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfV_consI s dclist \<Theta> dc x b c \<B> \<Gamma> v)
   show ?case proof
     show \<open>AF_typedef s dclist \<in> set \<Theta>'\<close> using wfV_consI by auto
     show \<open>(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist\<close> using wfV_consI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b \<close> using wfV_consI by auto
   qed
 next
   case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
     show ?case proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>'\<close> using wfV_conspI by auto
     show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     show \<open>\<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b  \<close> using wfV_conspI by auto
     show "\<Theta>' ;  \<B>  \<turnstile>\<^sub>w\<^sub>f b "  using wfV_conspI by auto
     show "atom bv \<sharp> (\<Theta>', \<B>, \<Gamma>, b, v)" using wfV_conspI fresh_prodN by auto
   qed
 next
   case (wfTI z \<Theta> \<B> \<Gamma> b c)
   thus ?case using Wellformed.wfTI by auto
 next
   case (wfB_consI \<Theta> s dclist)
   show ?case proof 
     show \<open>   \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close> using wfB_consI by auto
     show \<open>AF_typedef s dclist \<in> set \<Theta>'\<close>  using wfB_consI by auto
   qed
 next   
   case (wfB_appI \<Theta> \<B> b s bv dclist)
   show ?case proof 
     show \<open>   \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close> using wfB_appI by auto
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>'\<close>  using wfB_appI by auto
     show "\<Theta>' ;   \<B>  \<turnstile>\<^sub>w\<^sub>f b" using wfB_appI by simp
   qed
 qed(metis wf_intros)+
 
 lemma wf_theta_weakening2: 
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B> :: \<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list and t::\<tau>
   shows 
          "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and     
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>)" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and
          "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq" and
          "\<Theta> ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<turnstile>\<^sub>w\<^sub>f \<Theta>' \<Longrightarrow> set \<Theta> \<subseteq> set \<Theta>' \<Longrightarrow> \<Theta>' ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft" 
  
 proof(nominal_induct b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
       avoiding: \<Theta>'     
 rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
   show ?case proof
     show \<open> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
     show \<open> \<Theta>' ; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI wf_theta_weakening1 by auto
     show \<open>atom bv \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI wf_theta_weakening1 by auto
   qed
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid  dclist \<Delta> \<Phi> cs b)
   show ?case proof
     show \<open> \<Theta>' ; \<B> ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : B_id tid \<close> using wfS_matchI wf_theta_weakening1 by auto
     show \<open>AF_typedef tid dclist \<in> set \<Theta>'\<close> using wfS_matchI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_matchI by auto
     show \<open> \<Theta>'  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfS_matchI by auto
     show \<open>\<Theta>'; \<Phi>; \<B>; \<Gamma>; \<Delta>; tid; dclist \<turnstile>\<^sub>w\<^sub>f cs : b \<close> using wfS_matchI by auto
   qed
 next
    case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   show ?case proof
     show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI wf_theta_weakening1 by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_varI wf_theta_weakening1 by auto
     show \<open>atom u \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, \<tau>, v, b)\<close> using wfS_varI by auto
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_varI by auto
   qed
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   show ?case proof
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_letI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, e, b)\<close> using wfS_letI by auto
   qed
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   show ?case proof
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_let2I wf_theta_weakening1 by auto
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b \<close> using wfS_let2I by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, s1, b, \<tau>)\<close> using wfS_let2I by auto
   qed
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   show ?case proof
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, \<Gamma>, \<tau>)\<close> using wfS_branchI by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_branchI by auto
   qed
 next
    case (wfPhi_consI f \<Phi> \<Theta> ft)
   show ?case proof
     show "f \<notin> name_of_fun ` set \<Phi>" using wfPhi_consI by auto
     show "\<Theta>' ; \<Phi> \<turnstile>\<^sub>w\<^sub>f ft"  using wfPhi_consI by auto
     show "\<Theta>' \<turnstile>\<^sub>w\<^sub>f \<Phi>"  using wfPhi_consI by auto
   qed
 next
   case (wfFTNone \<Theta> ft)
   then show ?case using  wf_intros by metis
 next
   case (wfFTSome \<Theta> bv ft)
   then show ?case using wf_intros by metis
 next
   case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
   thus ?case using Wellformed.wfFTI wf_theta_weakening1 by simp
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case proof  
     show \<open> \<Theta>' ; \<Phi> ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI wf_theta_weakening1 by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI wf_theta_weakening1 by auto
     show \<open> \<Theta>' ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_assertI wf_theta_weakening1 by auto
     have "atom x \<sharp> \<Theta>'" using wf_supp(6)[OF \<open>\<turnstile>\<^sub>w\<^sub>f \<Theta>' \<close>] fresh_def by auto
     thus  \<open>atom x \<sharp> (\<Phi>, \<Theta>', \<B>, \<Gamma>, \<Delta>, c, b, s)\<close> using wfS_assertI fresh_prodN fresh_def by simp
   qed
 qed(metis wf_intros wf_theta_weakening1 )+
 
 lemmas wf_theta_weakening = wf_theta_weakening1 wf_theta_weakening2
 
 lemma lookup_wfTD:
   fixes td::type_def
   assumes  "td \<in> set \<Theta>" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows "\<Theta> \<turnstile>\<^sub>w\<^sub>f td"
  using assms  proof(induct \<Theta> )
   case Nil
   then show ?case by auto
 next
   case (Cons td'  \<Theta>')
   then consider "td = td'" | "td \<in> set \<Theta>'" by auto
   then have "\<Theta>' \<turnstile>\<^sub>w\<^sub>f td" proof(cases)
     case 1
     then show ?thesis using Cons using wfTh_elims by auto
   next
     case 2
     then show ?thesis using Cons using wfTh_elims by auto
   qed
   then show ?case using wf_theta_weakening Cons  by (meson set_subset_Cons)
 qed
 
 subsection \<open>Simple\<close>
 
 lemma wfTh_dclist_unique:
   assumes   "wfTh \<Theta>" and "AF_typedef tid dclist1 \<in> set \<Theta>" and  "AF_typedef tid dclist2 \<in> set \<Theta>" 
   shows "dclist1 = dclist2"
 using assms proof(induct \<Theta> rule: \<Theta>_induct)
   case TNil
   then show ?case by auto
 next
   case (AF_typedef tid' dclist' \<Theta>')
   then show ?case using wfTh_elims
     by (metis image_eqI name_of_type.simps(1) set_ConsD type_def.eq_iff(1))
 next
   case (AF_typedef_poly tid bv dclist \<Theta>')
   then show ?case using wfTh_elims by auto
 qed
 
 lemma wfTs_ctor_unique:
   fixes dclist::"(string*\<tau>) list"
   assumes  "\<Theta> ; {||}  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
   shows "t1 = t2" 
   using assms proof(induct dclist rule: list.inducts)
   case Nil
   then show ?case by auto
 next
   case (Cons x1 x2)
   consider "x1 = (c,t1)" | "x1 = (c,t2)" | "x1 \<noteq> (c,t1) \<and> x1 \<noteq> (c,t2)" by auto
   thus ?case proof(cases)
     case 1
     then show ?thesis using Cons wfTs_elims set_ConsD
       by (metis fst_conv image_eqI prod.inject)
   next
     case 2
       then show ?thesis using Cons wfTs_elims set_ConsD
       by (metis fst_conv image_eqI prod.inject)
   next
     case 3
     then show ?thesis using Cons wfTs_elims by (metis set_ConsD)
   qed
 qed
 
 lemma wfTD_ctor_unique:
   assumes  "\<Theta> \<turnstile>\<^sub>w\<^sub>f (AF_typedef tid dclist)" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
   shows "t1 = t2" 
   using wfTD_elims wfTs_elims assms  wfTs_ctor_unique by metis
 
 lemma wfTh_ctor_unique:
   assumes   "wfTh \<Theta>" and "AF_typedef tid dclist \<in> set \<Theta>" and "(c, t1) \<in> set dclist"  and "(c,t2) \<in> set dclist"  
   shows "t1 = t2" 
   using lookup_wfTD wfTD_ctor_unique assms by metis
 
 lemma wfTs_supp_t:
   fixes dclist::"(string*\<tau>) list"
   assumes "(c,t) \<in> set dclist" and "\<Theta> ; B ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" 
   shows "supp t \<subseteq> supp B"
 using assms proof(induct dclist arbitrary: c t rule:list.induct)
   case Nil
   then show ?case by auto
 next
   case (Cons ct dclist')
   then consider "ct = (c,t)" | "(c,t) \<in> set dclist'" by auto
   then show ?case proof(cases)
     case 1
     then have "\<Theta> ; B ; GNil \<turnstile>\<^sub>w\<^sub>f t" using Cons wfTs_elims by blast
     thus ?thesis using wfT_supp atom_dom.simps by force
   next
     case 2
     then show ?thesis using Cons wfTs_elims by metis
   qed
 qed
 
 lemma wfTh_lookup_supp_empty:
   fixes t::\<tau>
   assumes  "AF_typedef tid dclist \<in> set \<Theta>" and "(c,t) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows "supp t = {}" 
 proof - 
   have "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" using assms lookup_wfTD  wfTD_elims by metis
   thus ?thesis using wfTs_supp_t assms by force
 qed
 
 lemma wfTh_supp_b:
   assumes  "AF_typedef tid dclist \<in> set \<Theta>" and "(dc,\<lbrace> z : b | c \<rbrace> ) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows "supp b = {}" 
   using assms wfTh_lookup_supp_empty \<tau>.supp by blast
 
 lemma wfTh_b_eq_iff:
   fixes bva1::bv and bva2::bv and dc::string 
   assumes "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1" and "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" and
    "wfTs P {|bva1|} GNil dclist1" and  "wfTs P {|bva2|} GNil dclist2" 
   "[[atom bva1]]lst.dclist1 = [[atom bva2]]lst.dclist2"
  shows  "[[atom bva1]]lst. (dc,\<lbrace> x1 : b1  | c1 \<rbrace>) = [[atom bva2]]lst. (dc,\<lbrace> x2 : b2  | c2 \<rbrace>)"
 using assms proof(induct dclist1 arbitrary: dclist2)
   case Nil
   then show ?case by auto
 next
   case (Cons dct1' dclist1')
   show ?case proof(cases "dclist2 = []")
     case True
     then show ?thesis using Cons by auto
   next
     case False
     then obtain dct2' and dclist2' where cons:"dct2' # dclist2' = dclist2" using list.exhaust by metis
     hence *:"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'" 
       using Cons lst_head_cons Cons cons by metis
     hence **: "fst dct1' = fst dct2'" using lst_fst[THEN lst_pure] 
       by (metis (no_types) \<open>[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'\<close> 
             \<open>\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \<Longrightarrow> t1 = t2\<close> fst_conv surj_pair)    
     show ?thesis proof(cases "fst dct1' = dc")
       case True
       have "dc \<notin> fst ` set dclist1'" using  wfTs_elims Cons by (metis True fstI)
       hence 1:"(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) = dct1'" using Cons by (metis fstI image_iff set_ConsD)
       have "dc \<notin> fst ` set dclist2'" using  wfTs_elims Cons cons 
         by (metis "**" True fstI)
       hence 2:"(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) = dct2' " using Cons cons  by (metis  fst_conv image_eqI set_ConsD)
       then show ?thesis using Cons *  1 2   by blast
     next
       case False
       hence "fst dct2' \<noteq> dc" using **  by auto
       hence "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1' \<and> (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2' " using Cons cons False 
         by (metis fstI set_ConsD)
       moreover have "[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2'" using * False  by metis
       ultimately  show ?thesis using Cons ** *  
         using cons wfTs_elims(2) by blast
     qed
   qed
 qed
 
 
 subsection \<open>Polymorphic\<close>
 
 lemma wfTh_wfTs_poly:
   fixes dclist::"(string * \<tau>) list"
   assumes "AF_typedef_poly tyid bva dclist \<in> set P" and "\<turnstile>\<^sub>w\<^sub>f P"
   shows  "P ; {|bva|}  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist"
 proof -
   have *:"P \<turnstile>\<^sub>w\<^sub>f AF_typedef_poly tyid bva dclist" using lookup_wfTD assms by simp
 
   obtain bv lst where *:"P ; {|bv|}  ; GNil \<turnstile>\<^sub>w\<^sub>f lst  \<and> 
        (\<forall>c. atom c \<sharp> (dclist, lst) \<longrightarrow> atom c \<sharp> (bva, bv, dclist, lst) \<longrightarrow> (bva \<leftrightarrow> c) \<bullet> dclist = (bv \<leftrightarrow> c) \<bullet> lst)"  
     using wfTD_elims(2)[OF *] by metis
 
   obtain c::bv where  **:"atom c \<sharp> ((dclist, lst),(bva, bv, dclist, lst))" using obtain_fresh by metis
   have "P ; {|bv|}  ; GNil \<turnstile>\<^sub>w\<^sub>f lst" using * by metis
   hence "wfTs ((bv \<leftrightarrow> c) \<bullet> P)  ((bv \<leftrightarrow> c) \<bullet> {|bv|})  ((bv \<leftrightarrow> c) \<bullet> GNil) ((bv \<leftrightarrow> c) \<bullet> lst)" using ** wfTs.eqvt by metis
   hence "wfTs P  {|c|}  GNil ((bva \<leftrightarrow> c) \<bullet> dclist)" using * theta_flip_eq fresh_GNil assms 
   proof -
     have "\<forall>b ba. (ba::bv \<leftrightarrow> b) \<bullet> P = P"  by (metis \<open>\<turnstile>\<^sub>w\<^sub>f P\<close> theta_flip_eq)
     then show ?thesis
       using "*" "**" \<open>(bv \<leftrightarrow> c) \<bullet> P ; (bv \<leftrightarrow> c) \<bullet> {|bv|} ; (bv \<leftrightarrow> c) \<bullet> GNil \<turnstile>\<^sub>w\<^sub>f (bv \<leftrightarrow> c) \<bullet> lst\<close> by fastforce
   qed
   hence "wfTs ((bva \<leftrightarrow> c) \<bullet> P)  ((bva \<leftrightarrow> c) \<bullet> {|bva|})  ((bva \<leftrightarrow> c) \<bullet> GNil) ((bva \<leftrightarrow> c) \<bullet> dclist)" 
          using wfTs.eqvt fresh_GNil 
          by (simp add: assms(2) theta_flip_eq2)
 
   thus ?thesis using wfTs.eqvt permute_flip_cancel by metis
 qed
 
 lemma wfTh_dclist_poly_unique:
   assumes   "wfTh \<Theta>" and "AF_typedef_poly tid bva dclist1 \<in> set \<Theta>" and  "AF_typedef_poly tid bva2 dclist2 \<in> set \<Theta>" 
   shows "[[atom bva]]lst. dclist1 = [[atom bva2]]lst.dclist2"
 using assms proof(induct \<Theta> rule: \<Theta>_induct)
   case TNil
   then show ?case by auto
 next
   case (AF_typedef tid' dclist' \<Theta>')
   then show ?case using wfTh_elims by auto
 next
   case (AF_typedef_poly tid bv dclist \<Theta>')
   then show ?case using wfTh_elims  image_eqI name_of_type.simps set_ConsD type_def.eq_iff 
     by (metis Abs1_eq(3))
 qed
 
 lemma wfTh_poly_lookup_supp:
   fixes t::\<tau>
   assumes  "AF_typedef_poly tid bv dclist \<in> set \<Theta>" and "(c,t) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows "supp t \<subseteq> {atom bv}" 
 proof - 
   have "supp dclist  \<subseteq> {atom bv}"   using assms lookup_wfTD  wf_supp1 type_def.supp 
     by (metis Diff_single_insert Un_subset_iff list.simps(15) supp_Nil supp_of_atom_list)
   then show ?thesis using assms(2) proof(induct dclist)
     case Nil
     then show ?case by auto
   next
     case (Cons a dclist)
     then show ?case using supp_Pair supp_Cons 
-      by (metis (mono_tags, hide_lams) Un_empty_left Un_empty_right pure_supp subset_Un_eq subset_singletonD supp_list_member)
+      by (metis (mono_tags, opaque_lifting) Un_empty_left Un_empty_right pure_supp subset_Un_eq subset_singletonD supp_list_member)
   qed
 qed
   
 lemma wfTh_poly_supp_b:
   assumes  "AF_typedef_poly tid  bv dclist \<in> set \<Theta>" and "(dc,\<lbrace> z : b | c \<rbrace> ) \<in> set dclist" and "\<turnstile>\<^sub>w\<^sub>f \<Theta>"
   shows "supp b \<subseteq> {atom bv}" 
   using assms wfTh_poly_lookup_supp \<tau>.supp by force
 
 lemma subst_g_inside:  
   fixes x::x and c::c and \<Gamma>::\<Gamma>  and \<Gamma>'::\<Gamma>
   assumes "wfG P \<B> (\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)" 
   shows  "(\<Gamma>' @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)[x::=v]\<^sub>\<Gamma>\<^sub>v =  (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  
 using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case using subst_gb.simps by simp
 next
   case (GCons x' b' c' G) 
   hence wfg:"wfG P \<B> (G @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>) \<and> atom x' \<sharp> (G @ (x, b, c[z::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>)" using wfG_elims(2) 
     using GCons.prems append_g.simps by metis 
   hence "atom x \<notin> atom_dom ((x', b', c')  #\<^sub>\<Gamma> G)"  using  GCons wfG_inside_fresh by fast
   hence "x\<noteq>x'" 
     using  GCons append_Cons  wfG_inside_fresh atom_dom.simps toSet.simps by simp
   hence "((GCons (x', b', c') G) @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v  =  
          (GCons (x', b', c') (G @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>)))[x::=v]\<^sub>\<Gamma>\<^sub>v" by auto
   also have "... =  GCons (x', b', c'[x::=v]\<^sub>c\<^sub>v) ((G @ (GCons (x, b, c[z::=V_var x]\<^sub>c\<^sub>v) \<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v)"  
       using subst_gv.simps \<open>x\<noteq>x'\<close> by simp
   also have "... = (x', b', c'[x::=v]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> (G[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>)" using GCons  wfg by blast
   also have "... = ((x', b', c')  #\<^sub>\<Gamma> G)[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma>"  using subst_gv.simps \<open>x\<noteq>x'\<close>  by simp
   finally show ?case by auto
 qed
 
 lemma wfTh_td_eq: 
   assumes "td1 \<in> set (td2 # P)" and "wfTh (td2 # P)" and "name_of_type td1 = name_of_type td2"
   shows "td1 = td2"
 proof(rule ccontr)
   assume as: "td1 \<noteq> td2"
   have "name_of_type td2 \<notin> name_of_type ` set P" using wfTh_elims(2)[OF assms(2)] by metis
   moreover have "td1 \<in> set P" using assms as by simp
   ultimately have "name_of_type td1 \<noteq> name_of_type td2"
     by (metis rev_image_eqI)
   thus False using assms by auto
 qed
 
 lemma wfTh_td_unique:
   assumes "td1 \<in> set P" and "td2  \<in> set P" and "wfTh P" and "name_of_type td1 = name_of_type td2"
   shows "td1 = td2"
 using assms proof(induct P rule: list.induct)
   case Nil
   then show ?case by auto
 next
   case (Cons td \<Theta>')
   consider "td = td1" | "td = td2" | "td \<noteq> td1 \<and> td \<noteq> td2" by auto
   then  show ?case proof(cases)
     case 1
     then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis
   next
     case 2
     then show ?thesis using Cons wfTh_elims wfTh_td_eq by metis
   next
     case 3
     then show ?thesis using Cons wfTh_elims by auto
   qed
 qed
 
 lemma wfTs_distinct:
  fixes dclist::"(string * \<tau>) list"
  assumes "\<Theta> ; B  ; GNil \<turnstile>\<^sub>w\<^sub>f  dclist"
  shows "distinct (map fst dclist)"
 using assms proof(induct dclist rule: list.induct)
   case Nil
   then show ?case by auto
 next
   case (Cons x1 x2)
   then show ?case
       by (metis Cons.hyps Cons.prems distinct.simps(2) fst_conv list.set_map list.simps(9) wfTs_elims(2)) 
 qed 
 
 lemma wfTh_dclist_distinct:
   assumes "AF_typedef s dclist \<in> set P" and "wfTh P"
   shows "distinct (map fst  dclist)"
 proof - 
   have "wfTD P (AF_typedef s dclist)" using assms lookup_wfTD by auto
   hence "wfTs P {||} GNil dclist" using wfTD_elims by metis
   thus ?thesis using wfTs_distinct by metis
 qed
 
 lemma wfTh_dc_t_unique2:
   assumes "AF_typedef s dclist' \<in> set P" and "(dc,tc' ) \<in> set dclist'" and "AF_typedef s dclist \<in> set P" and "wfTh P" and
         "(dc,  tc) \<in> set dclist"
       shows "tc= tc'"
 proof - 
   have "dclist = dclist'" using assms wfTh_td_unique name_of_type.simps by force
   moreover have "distinct (map fst  dclist)"  using wfTh_dclist_distinct assms by auto
   ultimately show ?thesis using assms 
     by (meson eq_key_imp_eq_value)
 qed
 
 lemma wfTh_dc_t_unique:
   assumes "AF_typedef s dclist' \<in> set P" and "(dc, \<lbrace> x' : b'  | c' \<rbrace> ) \<in> set dclist'" and "AF_typedef s dclist \<in> set P" and "wfTh P" and
         "(dc,  \<lbrace> x : b  | c \<rbrace>) \<in> set dclist"
       shows "\<lbrace> x' : b'  | c' \<rbrace>= \<lbrace> x : b  | c \<rbrace>"
   using assms wfTh_dc_t_unique2 by metis
 
 lemma wfTs_wfT:
   fixes dclist::"(string *\<tau>) list" and t::\<tau>
   assumes "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f dclist"  and "(dc,t) \<in> set dclist" 
   shows "\<Theta>; \<B>; GNil  \<turnstile>\<^sub>w\<^sub>f t"
 using assms proof(induct dclist rule:list.induct)
   case Nil
   then show ?case by auto
 next
   case (Cons x1 x2)
   thus ?case using  wfTs_elims(2)[OF Cons(2)] by auto
 qed
 
 lemma wfTh_wfT:
   fixes t::\<tau>
   assumes "wfTh P"  and "AF_typedef tid dclist \<in> set P" and "(dc,t) \<in> set dclist" 
   shows "P ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f t"
 proof - 
   have "P  \<turnstile>\<^sub>w\<^sub>f AF_typedef tid dclist" using lookup_wfTD assms by auto
   hence "P ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f dclist" using wfTD_elims by auto
   thus ?thesis using wfTs_wfT assms by auto
 qed
 
 lemma td_lookup_eq_iff:
   fixes dc :: string and bva1::bv and bva2::bv
   assumes "[[atom bva1]]lst. dclist1 = [[atom bva2]]lst. dclist2" and "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist1" 
   shows "\<exists>x2 b2 c2. (dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" 
 using assms proof(induct dclist1 arbitrary: dclist2)
   case Nil
   then show ?case by auto
 next
   case (Cons dct1' dclist1')
   then obtain dct2' and dclist2' where cons:"dct2' # dclist2' = dclist2"   using  lst_head_cons_neq_nil[OF Cons(2)] list.exhaust by metis
   hence *:"[[atom bva1]]lst. dclist1' = [[atom bva2]]lst. dclist2' \<and> [[atom bva1]]lst. dct1' = [[atom bva2]]lst. dct2'" 
     using Cons lst_head_cons Cons cons by metis
   show ?case proof(cases "dc=fst dct1'")
     case True
     hence "dc = fst dct2'" using * lst_fst[ THEN lst_pure ] 
     proof -
       show ?thesis
         by (metis (no_types) "local.*" True \<open>\<And>x2 x1 t2' t2a t2 t1. [[atom x1]]lst. (t1, t2a) = [[atom x2]]lst. (t2, t2') \<Longrightarrow> t1 = t2\<close> prod.exhaust_sel) (* 31 ms *)
     qed    
     obtain x2 b2 and c2 where "snd dct2' = \<lbrace> x2 : b2  | c2 \<rbrace>" using obtain_fresh_z by metis
     hence "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) = dct2'" using  \<open>dc = fst dct2'\<close> 
       by (metis prod.exhaust_sel)
     then show ?thesis using cons by force
   next
     case False
     hence "(dc, \<lbrace> x : b  | c \<rbrace>) \<in> set dclist1'" using Cons by auto
     then show ?thesis using Cons 
       by (metis "local.*" cons list.set_intros(2))
   qed
 qed
 
 lemma lst_t_b_eq_iff:
   fixes bva1::bv and bva2::bv
   assumes "[[atom bva1]]lst. \<lbrace> x1 : b1  | c1 \<rbrace> = [[atom bva2]]lst. \<lbrace> x2 : b2  | c2 \<rbrace>" 
   shows "[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2" 
 proof(subst  Abs1_eq_iff_all(3)[of bva1 b1  bva2 b2],rule,rule,rule)
   fix c::bv
   assume "atom c \<sharp> ( \<lbrace> x1 : b1  | c1 \<rbrace> ,  \<lbrace> x2 : b2  | c2 \<rbrace>)" and "atom c \<sharp> (bva1, bva2, b1, b2)"
 
   show "(bva1 \<leftrightarrow> c) \<bullet> b1 = (bva2 \<leftrightarrow> c) \<bullet> b2" using assms Abs1_eq_iff(3) assms 
     by (metis Abs1_eq_iff_fresh(3) \<open>atom c \<sharp> (bva1, bva2, b1, b2)\<close> \<tau>.fresh \<tau>.perm_simps type_eq_subst_eq2(2))
 qed
 
 lemma wfTh_typedef_poly_b_eq_iff:  
   assumes "AF_typedef_poly tyid bva1 dclist1 \<in> set P" and "(dc, \<lbrace> x1 : b1  | c1 \<rbrace>) \<in> set dclist1"
   and "AF_typedef_poly tyid bva2 dclist2 \<in> set P" and "(dc, \<lbrace> x2 : b2  | c2 \<rbrace>) \<in> set dclist2" and "\<turnstile>\<^sub>w\<^sub>f P"
 shows "b1[bva1::=b]\<^sub>b\<^sub>b = b2[bva2::=b]\<^sub>b\<^sub>b"
 proof - 
   have "[[atom bva1]]lst. dclist1 = [[atom bva2]]lst.dclist2" using assms wfTh_dclist_poly_unique by metis
   hence "[[atom bva1]]lst. (dc,\<lbrace> x1 : b1  | c1 \<rbrace>) = [[atom bva2]]lst. (dc,\<lbrace> x2 : b2  | c2 \<rbrace>)" using wfTh_b_eq_iff assms wfTh_wfTs_poly by metis
   hence "[[atom bva1]]lst. \<lbrace> x1 : b1  | c1 \<rbrace> = [[atom bva2]]lst. \<lbrace> x2 : b2  | c2 \<rbrace>" using lst_snd by metis
   hence "[[atom bva1]]lst. b1 = [[atom bva2]]lst.b2" using lst_t_b_eq_iff by metis
   thus ?thesis using subst_b_flip_eq_two subst_b_b_def by metis
 qed
 
 section \<open>Equivariance Lemmas\<close>
 
 lemma x_not_in_u_set[simp]:
   fixes  x::x and us::"u fset"
   shows "atom x \<notin> supp us"
   by(induct us,auto, simp add: supp_finsert supp_at_base)
 
 lemma wfS_flip_eq:
   fixes s1::s and x1::x and s2::s and x2::x  and \<Delta>::\<Delta>
   assumes "[[atom x1]]lst. s1 = [[atom x2]]lst. s2" and "[[atom x1]]lst. t1 = [[atom x2]]lst. t2"  and "[[atom x1]]lst. c1 = [[atom x2]]lst. c2" and "atom x2 \<sharp> \<Gamma>" and
            " \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>"  and
         "\<Theta> ; \<Phi>  ; \<B> ; (x1, b, c1)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of t1"
        shows  "\<Theta> ; \<Phi>  ; \<B> ; (x2, b, c2)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f s2 : b_of t2"
 proof(cases "x1=x2")
   case True
   hence "s1 = s2 \<and> t1 = t2 \<and> c1 = c2" using assms Abs1_eq_iff by metis
   then show ?thesis using assms True by simp
 next
   case False
   have "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and>  \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>" using wfX_wfY assms by metis
   moreover have "atom x1 \<sharp> \<Gamma>" using wfX_wfY wfG_elims assms by metis
   moreover hence "atom x1 \<sharp> \<Delta> \<and> atom x2 \<sharp> \<Delta> " using wfD_x_fresh assms by auto
   ultimately have " \<Theta> ; \<Phi>  ; \<B> ; (x2 \<leftrightarrow> x1) \<bullet> ((x1, b, c1)  #\<^sub>\<Gamma>  \<Gamma>) ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 :  (x2 \<leftrightarrow> x1) \<bullet> b_of t1"
     using wfS.eqvt theta_flip_eq phi_flip_eq assms  flip_base_eq beta_flip_eq flip_fresh_fresh supp_b_empty by metis
   hence   " \<Theta> ; \<Phi>  ; \<B> ;  ((x2, b, (x2 \<leftrightarrow> x1) \<bullet> c1)  #\<^sub>\<Gamma>  ((x2 \<leftrightarrow> x1) \<bullet> \<Gamma>)) ; \<Delta>  \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 :   b_of ((x2 \<leftrightarrow> x2) \<bullet> t1)"  by fastforce
   thus ?thesis using assms Abs1_eq_iff 
   proof -
    have f1: "x2 = x1 \<and> t2 = t1 \<or> x2 \<noteq> x1 \<and> t2 = (x2 \<leftrightarrow> x1) \<bullet> t1 \<and> atom x2 \<sharp> t1"
      by (metis (full_types) Abs1_eq_iff(3) \<open>[[atom x1]]lst. t1 = [[atom x2]]lst. t2\<close>) (* 125 ms *)
    then have "x2 \<noteq> x1 \<and> s2 = (x2 \<leftrightarrow> x1) \<bullet> s1 \<and> atom x2 \<sharp> s1 \<longrightarrow> b_of t2 = (x2 \<leftrightarrow> x1) \<bullet> b_of t1"
      by (metis b_of.eqvt) (* 0.0 ms *)
    then show ?thesis
     using f1 by (metis (no_types) Abs1_eq_iff(3) G_cons_flip_fresh3 \<open>[[atom x1]]lst. c1 = [[atom x2]]lst. c2\<close> \<open>[[atom x1]]lst. s1 = [[atom x2]]lst. s2\<close> \<open>\<Theta> ; \<Phi>  ; \<B> ; (x1, b, c1)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of t1\<close> \<open>\<Theta> ; \<Phi>  ; \<B> ; (x2 \<leftrightarrow> x1) \<bullet> ((x1, b, c1)  #\<^sub>\<Gamma> \<Gamma>) ; \<Delta> \<turnstile>\<^sub>w\<^sub>f (x2 \<leftrightarrow> x1) \<bullet> s1 : (x2 \<leftrightarrow> x1) \<bullet> b_of t1\<close> \<open>atom x1 \<sharp> \<Gamma>\<close> \<open>atom x2 \<sharp> \<Gamma>\<close>) (* 593 ms *)
   qed
 qed
 
 section \<open>Lookup\<close>
 
 lemma wf_not_in_prefix:
   assumes "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)"
   shows "x \<notin> fst ` toSet \<Gamma>'"
 using assms proof(induct \<Gamma>' rule: \<Gamma>.induct)
   case GNil
   then show ?case by simp
 next
   case (GCons xbc \<Gamma>')
   then obtain x' and b' and c'::c where xbc: "xbc=(x',b',c')" 
     using prod_cases3 by blast
   hence *:"(xbc  #\<^sub>\<Gamma> \<Gamma>') @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma> = ((x',b',c') #\<^sub>\<Gamma>(\<Gamma>'@ ((x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>)))" by simp
   hence "atom x' \<sharp> (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)" using wfG_elims(2) GCons by metis
     
   moreover have "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>' @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>)" using GCons wfG_elims * by metis
   ultimately have  "atom x' \<notin> atom_dom (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)" using wfG_dom_supp GCons append_g.simps xbc fresh_def by fast
   hence "x' \<noteq> x" using GCons fresh_GCons xbc by fastforce
   then show ?case using GCons xbc toSet.simps
     using Un_commute \<open>\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b1, c1)  #\<^sub>\<Gamma> \<Gamma>\<close> atom_dom.simps by auto
 qed
 
 lemma lookup_inside_wf[simp]:
   assumes "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>)"
   shows "Some (b1,c1) = lookup (\<Gamma>'@(x,b1,c1) #\<^sub>\<Gamma>\<Gamma>) x"
   using wf_not_in_prefix lookup_inside assms by fast
 
 lemma lookup_weakening:
   fixes \<Theta>::\<Theta> and \<Gamma>::\<Gamma> and \<Gamma>'::\<Gamma>
   assumes "Some (b,c) = lookup \<Gamma> x" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
   shows "Some (b,c) = lookup \<Gamma>' x"
 proof -
   have "(x,b,c) \<in> toSet \<Gamma> \<and> (\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma> \<longrightarrow> b'=b \<and> c'=c)" using assms lookup_iff toSet.simps by force
   hence "(x,b,c) \<in> toSet \<Gamma>'" using assms by auto
   moreover have "(\<forall>b' c'. (x,b',c') \<in> toSet \<Gamma>' \<longrightarrow> b'=b \<and> c'=c)" using assms wf_g_unique 
     using calculation by auto
   ultimately show ?thesis using lookup_iff 
     using assms(3) by blast
 qed
 
 lemma wfPhi_lookup_fun_unique:
   fixes \<Phi>::\<Phi>
   assumes "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "AF_fundef f fd \<in> set \<Phi>" 
   shows "Some (AF_fundef f fd) = lookup_fun \<Phi> f"
 using assms proof(induct \<Phi> rule: list.induct )
   case Nil
   then show ?case using lookup_fun.simps by simp
 next
   case (Cons  a  \<Phi>')
   then obtain f' and fd' where a:"a = AF_fundef f' fd'" using fun_def.exhaust by auto  
   have wf: "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<and> f' \<notin> name_of_fun ` set \<Phi>' " using wfPhi_elims Cons a by metis
   then show ?case  using Cons lookup_fun.simps using Cons  lookup_fun.simps wf a 
       by (metis image_eqI name_of_fun.simps set_ConsD)
 qed
 
 lemma lookup_fun_weakening:
   fixes \<Phi>'::\<Phi>
   assumes "Some fd = lookup_fun \<Phi> f" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
   shows "Some fd = lookup_fun \<Phi>' f"
 using assms proof(induct \<Phi> )
   case Nil
   then show ?case using lookup_fun.simps by simp
 next
   case (Cons  a  \<Phi>'')
   then obtain f' and fd' where a: "a = AF_fundef f' fd'" using fun_def.exhaust by auto
   then show ?case proof(cases "f=f'")
     case True
     then show ?thesis using lookup_fun.simps Cons wfPhi_lookup_fun_unique a 
       by (metis lookup_fun_member subset_iff)
   next
     case False
     then show ?thesis  using lookup_fun.simps Cons 
       using \<open>a = AF_fundef f' fd'\<close> by auto
   qed
 qed
 
 lemma  fundef_poly_fresh_bv:
   assumes "atom bv2 \<sharp> (bv1,b1,c1,\<tau>1,s1)"
   shows  * : "(AF_fun_typ_some bv2 (AF_fun_typ x1 ((bv1\<leftrightarrow>bv2) \<bullet> b1) ((bv1\<leftrightarrow>bv2) \<bullet>c1) ((bv1\<leftrightarrow>bv2) \<bullet> \<tau>1) ((bv1\<leftrightarrow>bv2) \<bullet> s1)) = (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1)))" 
         (is "(AF_fun_typ_some ?bv ?fun_typ = AF_fun_typ_some ?bva ?fun_typa)")
 proof -
   have 1:"atom bv2 \<notin> set [atom x1]" using bv_not_in_x_atoms by simp
   have 2:"bv1 \<noteq> bv2" using assms by auto
   have 3:"(bv2 \<leftrightarrow> bv1) \<bullet> x1 = x1" using pure_fresh flip_fresh_fresh 
     by (simp add: flip_fresh_fresh)
   have "  AF_fun_typ x1 ((bv1 \<leftrightarrow> bv2) \<bullet> b1) ((bv1 \<leftrightarrow> bv2) \<bullet> c1) ((bv1 \<leftrightarrow> bv2) \<bullet> \<tau>1) ((bv1 \<leftrightarrow> bv2) \<bullet> s1) = (bv2 \<leftrightarrow> bv1) \<bullet> AF_fun_typ x1 b1 c1 \<tau>1 s1"
     using 1 2 3 assms   by (simp add: flip_commute)
   moreover have "(atom bv2 \<sharp> c1 \<and> atom bv2 \<sharp> \<tau>1 \<and> atom bv2 \<sharp> s1 \<or> atom bv2 \<in> set [atom x1])  \<and> atom bv2 \<sharp> b1" 
      using 1 2 3 assms  fresh_prod5 by metis
   ultimately show ?thesis unfolding  fun_typ_q.eq_iff  Abs1_eq_iff(3) fun_typ.fresh 1 2 by fastforce
 qed
 
 
 text \<open>It is possible to collapse some of the easy to prove inductive cases into a single proof at the qed line
    but this makes it fragile under change. For example, changing the lemma statement might make one of the previously
    trivial cases non-trivial and so the collapsing needs to be unpacked. Is there a way to find which case
    has failed in the qed line?\<close>
 
 lemma wb_b_weakening1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
           and cs::branch_s and css::branch_list
 
   shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>\<B> |\<subseteq>| \<B>'  \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  c" and
          "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>   \<Longrightarrow>\<B> |\<subseteq>| \<B>'  \<Longrightarrow> \<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f \<Gamma> " and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts  \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts" and 
          "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and     
          "wfB \<Theta> \<B> b \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> wfB \<Theta> \<B>' b" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta>; \<B>' ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
 proof(nominal_induct b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
      avoiding:  \<B>'
 rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
   show ?case proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by metis
     show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI  by auto
     show \<open> \<Theta> ;  \<B>'  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
     show \<open>atom bv \<sharp>  (\<Theta>, \<B>', \<Gamma>, b, v)\<close>  using fresh_prodN wfV_conspI by auto
     thus \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by simp
   qed
 next
  case (wfTI z \<Theta> \<B> \<Gamma> b c)
   show ?case proof 
     show "atom z \<sharp>  (\<Theta>, \<B>', \<Gamma>)" using wfTI by auto
     show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b " using wfTI by auto
     show "\<Theta>; \<B>' ; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c " using wfTI by auto
   qed
 qed( (auto simp add: wf_intros | metis wf_intros)+ )
 
 lemma wb_b_weakening2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
           and cs::branch_s and css::branch_list
 
   shows 
          "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi> ; \<B>' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi> ; \<B>' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta> ; \<Phi> ; \<B>' ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta> ; \<Phi> ; \<B>' ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow>  \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi>  ; \<B>' \<turnstile>\<^sub>w\<^sub>f ft"
 proof(nominal_induct b and b and b and b and \<Phi> and \<Delta> and ftq and ft  
    avoiding:  \<B>'
    rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros  wb_b_weakening1 by metis
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros  wb_b_weakening1 by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   then show ?case  using wf_intros  wb_b_weakening1 
     by meson
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using Wellformed.wfE_fstI  wb_b_weakening1 by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_intros  wb_b_weakening1 by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1) 
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f ft v)
   then show ?case using wf_intros using wb_b_weakening1  by meson
 next
   case (wfE_appPI \<Theta> \<Phi> \<B>1 \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f1 x1 b1 c1 s1)
 
   have "\<Theta> ; \<Phi>  ; \<B>' ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f AE_appP f1 b' v1 : (b_of \<tau>1)[bv1::=b']\<^sub>b" 
   proof
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appPI by auto
     show "\<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> "  using wfE_appPI by auto
     show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b' "  using wfE_appPI wb_b_weakening1 by auto
     thus " atom bv1 \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, b', v1, (b_of \<tau>1)[bv1::=b']\<^sub>b)"  
       using  wfE_appPI fresh_prodN by auto
 
     show "Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f1"  using wfE_appPI by auto
     show "\<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v1 : b1[bv1::=b']\<^sub>b "  using wfE_appPI wb_b_weakening1 by auto
   qed
   then show ?case by auto
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   show ?case proof
     show \<open> \<Theta> ; \<Phi>  ; \<B>' ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
     show \<open> \<Theta> ; \<Phi>  ; \<B>' ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by auto
     show \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_letI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, e, b)\<close> using wfS_letI by auto
   qed
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   then show ?case using wb_b_weakening1 Wellformed.wfS_let2I by simp
 next
   case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
   then show ?case using  wb_b_weakening1 Wellformed.wfS_ifI by simp
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Delta> \<Phi> s b)
   then show ?case using wb_b_weakening1 Wellformed.wfS_varI by simp
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   then show ?case using wb_b_weakening1 Wellformed.wfS_assignI by simp
 next
 case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using wb_b_weakening1 Wellformed.wfS_whileI by simp
 next
   case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using Wellformed.wfS_seqI   by metis
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   then show ?case using  wb_b_weakening1 Wellformed.wfS_matchI by metis
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   then show ?case  using Wellformed.wfS_branchI by auto
 next
   case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
   then show ?case  using wf_intros by metis
 next
   case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
   then show ?case  using wf_intros by metis
 next
   case (wfD_emptyI \<Theta> \<B> \<Gamma>)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfPhi_emptyI \<Theta>)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfPhi_consI f \<Theta> \<Phi> ft)
   then show ?case using wf_intros wb_b_weakening1 by metis
 next
   case (wfFTSome \<Theta> bv ft)
   then show ?case  using wf_intros wb_b_weakening1 by metis
 next
   case (wfFTI \<Theta> B b s x c \<tau> \<Phi>)
   show ?case proof
     show "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f b"   using wfFTI wb_b_weakening1 by auto
     
     show "supp c \<subseteq> {atom x}" using wfFTI wb_b_weakening1 by auto
     show "\<Theta>; \<B>' ; (x, b, c) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfFTI wb_b_weakening1 by auto
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfFTI wb_b_weakening1 by auto
     from \<open> B |\<subseteq>| \<B>'\<close> have "supp B \<subseteq> supp \<B>'" proof(induct B)
       case empty
       then show ?case by auto
     next
       case (insert x B)
       then show ?case 
         by (metis fsubset_funion_eq subset_Un_eq supp_union_fset)
     qed
     thus  "supp s \<subseteq> {atom x} \<union> supp \<B>'" using wfFTI by auto
   qed  
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case proof
     show \<open> \<Theta> ; \<Phi> ; \<B>' ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wb_b_weakening1 wfS_assertI by simp
     show \<open> \<Theta>; \<B>' ; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close>  using wb_b_weakening1 wfS_assertI by simp
     show \<open> \<Theta>; \<B>' ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wb_b_weakening1 wfS_assertI by simp
     have "atom x \<sharp>  \<B>'" using x_not_in_b_set fresh_def by metis
     thus  \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>', \<Gamma>, \<Delta>, c, b, s)\<close> using wfS_assertI fresh_prodN by simp
   qed   
 qed(auto)
 
 lemmas wb_b_weakening = wb_b_weakening1 wb_b_weakening2
 
 lemma wfG_b_weakening:
   fixes \<Gamma>::\<Gamma>
   assumes "\<B> |\<subseteq>| \<B>'" and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"
   shows "\<Theta>; \<B>'  \<turnstile>\<^sub>w\<^sub>f \<Gamma> "
   using wb_b_weakening assms by auto
 
 lemma wfT_b_weakening:
   fixes \<Gamma>::\<Gamma> and \<Theta>::\<Theta> and \<tau>::\<tau>
   assumes "\<B> |\<subseteq>| \<B>'" and "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>"
   shows "\<Theta>; \<B>' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> "
   using wb_b_weakening assms by auto
 
 lemma wfB_subst_wfB:
   fixes \<tau>::\<tau> and b'::b and b::b
   assumes "\<Theta> ; {|bv|}  \<turnstile>\<^sub>w\<^sub>f b" and "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b'"
   shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b[bv::=b']\<^sub>b\<^sub>b "
 using assms proof(nominal_induct b rule:b.strong_induct)
   case B_int
   hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_int" using wfB_intI wfX_wfY by fast
   then show ?case using subst_bb.simps wb_b_weakening by fastforce
 next
   case B_bool
   hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_bool" using wfB_boolI wfX_wfY by fast
   then show ?case using subst_bb.simps wb_b_weakening by fastforce
 next
   case (B_id x )
   hence " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (B_id x)" using wfB_consI wfB_elims wfX_wfY by metis
   then show ?case using  subst_bb.simps(4) by auto
 next
   case (B_pair x1 x2)
   then show ?case using subst_bb.simps 
     by (metis wfB_elims(1) wfB_pairI)
 next
   case B_unit
   hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_unit" using wfB_unitI wfX_wfY by fast
   then show ?case using subst_bb.simps wb_b_weakening by fastforce
 next
   case B_bitvec
   hence  "\<Theta> ; {||}  \<turnstile>\<^sub>w\<^sub>f B_bitvec" using wfB_bitvecI wfX_wfY by fast
   then show ?case using subst_bb.simps wb_b_weakening by fastforce
 next
   case (B_var x)
   then show ?case 
   proof -
     have False
       using B_var.prems(1) wfB.cases by fastforce (* 781 ms *)
     then show ?thesis  by metis 
   qed
 next
   case (B_app s b)
   then obtain bv' dclist where *:"AF_typedef_poly s bv' dclist \<in> set \<Theta> \<and> \<Theta> ; {|bv|}   \<turnstile>\<^sub>w\<^sub>f b" using wfB_elims by metis
   show ?case unfolding subst_b_simps proof
     show "\<turnstile>\<^sub>w\<^sub>f \<Theta> " using B_app wfX_wfY by metis
     show "\<Theta> ;   \<B>  \<turnstile>\<^sub>w\<^sub>f b[bv::=b']\<^sub>b\<^sub>b " using * B_app forget_subst wfB_supp fresh_def 
       by (metis ex_in_conv subset_empty subst_b_b_def supp_empty_fset)
     show "AF_typedef_poly s bv' dclist \<in> set \<Theta>" using * by auto
   qed
 qed
 
 lemma wfT_subst_wfB:
   fixes \<tau>::\<tau> and b'::b
   assumes "\<Theta> ; {|bv|} ; (x, b, c)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>" and "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b'"
   shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (b_of \<tau>)[bv::=b']\<^sub>b\<^sub>b "
 proof -
   obtain b where  "\<Theta> ; {|bv|} \<turnstile>\<^sub>w\<^sub>f b \<and> b_of \<tau> = b" using wfT_elims b_of.simps assms by metis
   thus ?thesis using wfB_subst_wfB assms by auto
 qed
 
 lemma wfG_cons_unique:
   assumes "(x1,b1,c1) \<in> toSet (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x = x1"
   shows "b1 = b \<and> c1 = c" 
 proof -
   have "x1 \<notin> fst ` toSet \<Gamma>" 
   proof -
     have "atom x1 \<sharp> \<Gamma>" using assms wfG_cons by metis
     then show ?thesis
       using fresh_gamma_elem 
       by (metis assms(2) atom_dom.simps dom.simps rev_image_eqI wfG_cons2 wfG_x_fresh)
   qed
   thus ?thesis using assms by force
 qed
 
 lemma wfG_member_unique:
   assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x = x1"
   shows "b1 = b \<and> c1 = c" 
   using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case using wfG_suffix wfG_cons_unique append_g.simps by metis
 next
   case (GCons x' b' c' \<Gamma>')
   moreover hence "(x1, b1, c1) \<in> toSet (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" using wf_not_in_prefix by fastforce
   ultimately show ?case using wfG_cons by fastforce
 qed
 
 section \<open>Function Definitions\<close>
 
 lemma wb_phi_weakening:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list and \<Phi>::\<Phi>
   shows
          "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b  \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow>   \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow>  \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and      
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
           "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> True" and       
           "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>'  \<turnstile>\<^sub>w\<^sub>f ftq" and
          "\<Theta> ; \<Phi> ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>  \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<Longrightarrow> set \<Phi>  \<subseteq> set \<Phi>' \<Longrightarrow> \<Theta> ; \<Phi>' ; \<B> \<turnstile>\<^sub>w\<^sub>f ft"      
 proof(nominal_induct
           b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
           avoiding:  \<Phi>'         
        rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   then show ?case using wf_intros by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_intros by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_intros by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   then show ?case using wf_intros by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
   then show ?case using wf_intros lookup_fun_weakening by metis
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
   show ?case proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
     show \<open>atom bv \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi>' f\<close> 
       using wfE_appPI lookup_fun_weakening by metis
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI by auto
   qed
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   then show ?case using wf_intros by metis
 next
   case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
   then show ?case using wf_intros by metis
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   then show ?case using Wellformed.wfS_letI by fastforce
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 b' x s2 b)
   then show ?case   using Wellformed.wfS_let2I by fastforce
 next
   case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
   then show ?case  using wf_intros by metis
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   show ?case proof
     show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI by simp
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_varI by simp
     show \<open>atom u \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, \<tau>, v, b)\<close> using wfS_varI by simp
     show \<open> \<Theta> ; \<Phi>' ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_varI by simp
   qed
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   then show ?case  using wf_intros by metis
 next
   case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case  using wf_intros by metis
 next
   case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case  using wf_intros by metis
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   then show ?case  using wf_intros by metis
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   then show ?case using Wellformed.wfS_branchI by fastforce
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case proof
     show \<open> \<Theta> ; \<Phi>' ; \<B> ; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_assertI by auto
   next
     show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI by auto
   next
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfS_assertI by auto
     have "atom x \<sharp> \<Phi>'" using wfS_assertI wfPhi_supp fresh_def by blast
     thus  \<open>atom x \<sharp> (\<Phi>', \<Theta>, \<B>, \<Gamma>, \<Delta>, c, b, s)\<close>  using fresh_prodN wfS_assertI wfPhi_supp fresh_def by auto
   qed
 next
   case (wfFTI \<Theta> B b s x c \<tau> \<Phi>)
   show ?case proof
     show \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b \<close>  using wfFTI by auto
   next
     show \<open>supp c \<subseteq> {atom x}\<close> using wfFTI by auto
   next
     show \<open> \<Theta> ; B ; (x, b, c) #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfFTI by auto
   next
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<close> using wfFTI by auto
   next
     show \<open>supp s \<subseteq> {atom x} \<union> supp B\<close> using wfFTI by auto
   qed
 qed(auto|metis wf_intros)+
 
 
 lemma wfT_fun_return_t:
   fixes \<tau>a'::\<tau> and \<tau>'::\<tau>
   assumes "\<Theta>; \<B>; (xa, b, ca)  #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>a'" and "(AF_fun_typ x b c \<tau>' s') = (AF_fun_typ xa b ca \<tau>a' sa')"
   shows  "\<Theta>; \<B>; (x, b, c)  #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>'"
 proof - 
   obtain cb::x where xf: "atom cb  \<sharp> (c, \<tau>', s', sa', \<tau>a', ca, x , xa)" using obtain_fresh by blast
   hence  "atom cb \<sharp> (c, \<tau>', s', sa', \<tau>a', ca) \<and>  atom cb \<sharp> (x, xa, ((c, \<tau>'), s'), (ca, \<tau>a'), sa')" using  fresh_prod6 fresh_prod4 fresh_prod8 by auto
   hence *:"c[x::=V_var cb]\<^sub>c\<^sub>v = ca[xa::=V_var cb]\<^sub>c\<^sub>v \<and> \<tau>'[x::=V_var cb]\<^sub>\<tau>\<^sub>v = \<tau>a'[xa::=V_var cb]\<^sub>\<tau>\<^sub>v" using assms \<tau>.eq_iff Abs1_eq_iff_all by auto
 
   have **: "\<Theta>; \<B>; (xa \<leftrightarrow> cb ) \<bullet> ((xa, b, ca)  #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f (xa \<leftrightarrow> cb ) \<bullet> \<tau>a'" using assms True_eqvt beta_flip_eq theta_flip_eq wfG_wf 
     by (metis GCons_eqvt GNil_eqvt wfT.eqvt wfT_wf)
 
   have "\<Theta>; \<B>; (x \<leftrightarrow> cb ) \<bullet> ((x, b, c)  #\<^sub>\<Gamma> GNil)  \<turnstile>\<^sub>w\<^sub>f (x \<leftrightarrow> cb ) \<bullet> \<tau>'" proof -
     have "(xa \<leftrightarrow> cb ) \<bullet> xa = (x \<leftrightarrow> cb ) \<bullet> x"  using xf by auto
     hence "(x \<leftrightarrow> cb ) \<bullet> ((x, b, c)  #\<^sub>\<Gamma> GNil) = (xa \<leftrightarrow> cb ) \<bullet> ((xa, b, ca)  #\<^sub>\<Gamma> GNil)"  using * ** xf G_cons_flip fresh_GNil by simp
     thus ?thesis using ** * xf by simp
   qed
   thus ?thesis  using  beta_flip_eq theta_flip_eq  wfT_wf wfG_wf  * ** True_eqvt wfT.eqvt permute_flip_cancel by metis
 qed
 
 lemma wfFT_wf_aux:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Delta>::\<Delta>
   assumes "\<Theta> ; \<Phi>  ; B \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" 
   shows "\<Theta> ; B ; (x,b,c) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta>  \<turnstile>\<^sub>w\<^sub>f  \<Phi> \<and> supp s \<subseteq> { atom x } \<union> supp B"
 proof -
   obtain xa and ca and sa and \<tau>' where *:"\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b  \<and>  (\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>  )  \<and>
     supp sa \<subseteq> {atom xa} \<union> supp B \<and>  (\<Theta> ; B ; (xa, b, ca)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>')  \<and>  
   AF_fun_typ x b c \<tau> s = AF_fun_typ xa b ca \<tau>' sa " 
     using wfFT.simps[of \<Theta> \<Phi> B "AF_fun_typ x b c \<tau> s"] assms by auto
  
   moreover hence **: "(AF_fun_typ x b c \<tau> s) = (AF_fun_typ xa b ca \<tau>' sa)" by simp
   ultimately have "\<Theta> ; B ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfT_fun_return_t by metis
   moreover have " (\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>  ) "  using * by auto
   moreover have "supp s \<subseteq> { atom x } \<union> supp B" proof -
     have "[[atom x]]lst.s = [[atom xa]]lst.sa" using ** fun_typ.eq_iff lst_fst lst_snd by metis
     thus ?thesis using lst_supp_subset * by metis
   qed
   ultimately show ?thesis by auto
 qed
 
 lemma wfFT_simple_wf:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Delta>::\<Delta>
   assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))" 
   shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> supp s \<subseteq> { atom x } "
 proof -
   have  *:"\<Theta> ; \<Phi>  ; {||} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using wfFTQ_elims assms by auto
   thus ?thesis using wfFT_wf_aux by force
 qed
 
 lemma wfFT_poly_wf:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ftq :: fun_typ_q and s::s and \<Delta>::\<Delta>
   assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))" 
   shows "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> \<Theta> ; \<Phi>  ; {|bv|}  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)"
 proof -
   obtain bv1 ft1 where  *:"\<Theta> ; \<Phi>  ; {|bv1|} \<turnstile>\<^sub>w\<^sub>f ft1 \<and> [[atom bv1]]lst. ft1 = [[atom bv]]lst. AF_fun_typ x b c \<tau> s" 
     using wfFTQ_elims(3)[OF assms]  by metis
 
   show ?thesis proof(cases "bv1 = bv")
     case True
-    then show ?thesis using *  fun_typ_q.eq_iff  Abs1_eq_iff   by (metis (no_types, hide_lams) wfFT_wf_aux)
+    then show ?thesis using *  fun_typ_q.eq_iff  Abs1_eq_iff   by (metis (no_types, opaque_lifting) wfFT_wf_aux)
   next
     case False
     obtain x1 b1 c1 t1 s1 where **: "ft1 = AF_fun_typ x1 b1 c1 t1 s1" using fun_typ.eq_iff 
       by (meson fun_typ.exhaust)
 
     hence eqv: "(bv \<leftrightarrow> bv1) \<bullet>  AF_fun_typ x1 b1 c1 t1 s1 = AF_fun_typ x b c \<tau> s \<and> atom bv1 \<sharp> AF_fun_typ x b c \<tau> s" using 
          Abs1_eq_iff(3) * False by metis
 
     have "(bv \<leftrightarrow> bv1) \<bullet> \<Theta> ; (bv \<leftrightarrow> bv1) \<bullet> \<Phi> ; (bv \<leftrightarrow> bv1) \<bullet> {|bv1|} \<turnstile>\<^sub>w\<^sub>f (bv \<leftrightarrow> bv1) \<bullet> ft1" using wfFT.eqvt * by metis   
     moreover have "(bv \<leftrightarrow> bv1) \<bullet> \<Phi> = \<Phi>" using phi_flip_eq wfX_wfY * by metis
     moreover have "(bv \<leftrightarrow> bv1) \<bullet> \<Theta> =\<Theta>" using wfX_wfY *  theta_flip_eq2 by metis
     moreover have "(bv \<leftrightarrow> bv1) \<bullet> ft1 = AF_fun_typ x b c \<tau> s" using eqv ** by metis
     ultimately have  "\<Theta> ; \<Phi>  ; {|bv|} \<turnstile>\<^sub>w\<^sub>f AF_fun_typ x b c \<tau> s"  by auto
     thus ?thesis using wfFT_wf_aux by auto
   qed
 qed
 
 lemma wfFT_poly_wfT:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "\<Theta> ; \<Phi>  \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))"
   shows "\<Theta> ; {| bv |} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
   using wfFT_poly_wf assms by simp
 
 lemma b_of_supp:
   "supp (b_of t) \<subseteq> supp t"
 proof(nominal_induct t rule:\<tau>.strong_induct)
   case (T_refined_type x b c)
   then show ?case by auto
 qed
 
 lemma wfPhi_f_simple_wf:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Phi>'::\<Phi>
    assumes "AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi> " and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
   shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<and> supp s \<subseteq> { atom x }"
 using assms proof(induct \<Phi> rule: \<Phi>_induct)
   case PNil
   then show ?case by auto
 next
   case (PConsSome f1 bv x1 b1 c1 \<tau>1 s' \<Phi>'')
   hence "AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" by auto
   moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsSome by auto
   ultimately show  ?case using PConsSome wfPhi_elims wfFT_simple_wf by auto
 next
   case (PConsNone f' x' b' c' \<tau>' s' \<Phi>'')
   show ?case proof(cases "f=f'")
     case True
     have "AF_fun_typ_none (AF_fun_typ x' b' c' \<tau>' s') = AF_fun_typ_none (AF_fun_typ x b c \<tau> s)" 
       by (metis PConsNone.prems(1) PConsNone.prems(2) True fun_def.eq_iff image_eqI name_of_fun.simps set_ConsD wfPhi_elims(2))
     hence *:"\<Theta> ; \<Phi>'' \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none (AF_fun_typ x b c \<tau> s) " using wfPhi_elims(2)[OF PConsNone(3)] by metis
     hence "\<Theta> ; \<Phi>'' ; {||} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using wfFTQ_elims(1) by metis
     thus ?thesis using wfFT_simple_wf[OF *] wb_phi_weakening PConsNone by force
   next
     case False
     hence "AF_fundef f (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" using PConsNone by simp
     moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsNone by auto
     ultimately show  ?thesis using PConsNone wfPhi_elims wfFT_simple_wf by auto
   qed
 qed
 
 lemma wfPhi_f_simple_wfT:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
   using wfPhi_f_simple_wf assms  using lookup_fun_member by blast
 
 lemma  wfPhi_f_simple_supp_b:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp b = {}"
 proof -
   have "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_simple_wfT assms by auto
   thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce
 qed
 
 lemma wfPhi_f_simple_supp_t:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp \<tau> \<subseteq> { atom x }"
   using wfPhi_f_simple_wfT wfT_supp assms by fastforce
 
 lemma  wfPhi_f_simple_supp_c:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp c \<subseteq> { atom x }"
 proof -
   have "\<Theta> ; {||} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_simple_wfT assms by auto
   thus ?thesis using wfG_wfC wfC_supp wfT_wf by fastforce
 qed
 
 lemma  wfPhi_f_simple_supp_s:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp s \<subseteq> {atom x}"
 proof -
   have "AF_fundef f  (AF_fun_typ_none (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>" using lookup_fun_member assms by auto
   hence "supp s \<subseteq> { atom x }" using wfPhi_f_simple_wf assms by blast
   thus ?thesis using wf_supp(3)  atom_dom.simps toSet.simps  x_not_in_u_set x_not_in_b_set setD.simps 
     using wf_supp2(2) by fastforce
 qed
 
 lemma wfPhi_f_poly_wf:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q and s::s and \<Phi>'::\<Phi>
    assumes "AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi> " and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>" and "set \<Phi> \<subseteq> set \<Phi>'" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>'"
   shows "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau> \<and> \<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>' \<and> \<Theta> ; \<Phi>' ;  {|bv|} \<turnstile>\<^sub>w\<^sub>f  (AF_fun_typ x b c \<tau> s)"
 using assms proof(induct \<Phi> rule: \<Phi>_induct)
   case PNil
   then show ?case by auto
 next
   case (PConsNone f x b c \<tau> s' \<Phi>'')
   moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsNone by auto
   ultimately show  ?case using PConsNone wfPhi_elims wfFT_poly_wf by auto
 next
   case (PConsSome f1 bv1 x1 b1 c1 \<tau>1 s1 \<Phi>'')
   show ?case proof(cases "f=f1")
   case True
     have "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1) = AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)"       
       by (metis PConsSome.prems(1) PConsSome.prems(2) True fun_def.eq_iff list.set_intros(1) option.inject wfPhi_lookup_fun_unique)
     hence *:"\<Theta> ; \<Phi>''  \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s) " using wfPhi_elims PConsSome by metis  
     thus ?thesis using wfFT_poly_wf * wb_phi_weakening PConsSome 
       by (meson set_subset_Cons)
   next
     case False
     hence "AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>''" using PConsSome 
       by (meson fun_def.eq_iff set_ConsD)
     moreover have " \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>'' \<and> set \<Phi>'' \<subseteq> set \<Phi>'" using wfPhi_elims(3) PConsSome 
       by (meson dual_order.trans set_subset_Cons)
     ultimately show  ?thesis using PConsSome wfPhi_elims wfFT_poly_wf 
       by blast
   qed
 qed
 
 lemma wfPhi_f_poly_wfT:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "\<Theta> ; {| bv |} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>"
 using assms proof(induct \<Phi> rule: \<Phi>_induct)
   case PNil
   then show ?case by auto
 next
   case (PConsSome f1 bv1 x1 b1 c1 \<tau>1 s' \<Phi>')
   then show ?case proof(cases "f1=f")
     case True
     hence "lookup_fun (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s'))  # \<Phi>') f = Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s')))" using 
        lookup_fun.simps  using PConsSome.prems by simp
     then show ?thesis using PConsSome.prems wfPhi_elims wfFT_poly_wfT
       by (metis option.inject)
   next
     case False
     then show ?thesis using PConsSome using lookup_fun.simps 
       using wfPhi_elims(3) by auto
   qed
 next
   case (PConsNone f' x' b' c' \<tau>' s' \<Phi>')
   then show ?case proof(cases "f'=f")
     case True
     then have *:"\<Theta> ; \<Phi>' \<turnstile>\<^sub>w\<^sub>f AF_fun_typ_none (AF_fun_typ x' b' c' \<tau>' s') " using lookup_fun.simps PConsNone wfPhi_elims by metis
     thus ?thesis using PConsNone wfFT_poly_wfT wfPhi_elims lookup_fun.simps 
       by (metis fun_def.eq_iff fun_typ_q.distinct(1) option.inject)
   next
     case False  
     thus ?thesis using PConsNone wfPhi_elims 
       by (metis False lookup_fun.simps(2))
   qed
 qed
 
 lemma  wfPhi_f_poly_supp_b:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp b \<subseteq> supp bv"
 proof -
   have "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_poly_wfT assms by auto
   thus ?thesis using wfT_wf wfG_cons wfB_supp by fastforce
 qed
 
 lemma wfPhi_f_poly_supp_t:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp \<tau> \<subseteq> { atom x , atom bv }"
  using wfPhi_f_poly_wfT[OF assms, THEN wfT_supp]  atom_dom.simps  supp_at_base by auto
 
 
 lemma wfPhi_f_poly_supp_b_of_t:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp (b_of \<tau>) \<subseteq> { atom bv }"
 proof - 
   have "atom x \<notin> supp (b_of \<tau>)" using x_fresh_b  by auto
   moreover have "supp (b_of \<tau>) \<subseteq> { atom x , atom bv }" using wfPhi_f_poly_supp_t  
     using   supp_at_base b_of.simps wfPhi_f_poly_supp_t \<tau>.supp b_of_supp assms by fast
   ultimately show ?thesis by blast
 qed
 
 lemma wfPhi_f_poly_supp_c:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp c \<subseteq> { atom x, atom bv }"
 proof - 
   have "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfPhi_f_poly_wfT assms by auto
   thus ?thesis using wfG_wfC wfC_supp wfT_wf 
     using supp_at_base by fastforce
 qed
 
 lemma  wfPhi_f_poly_supp_s:
   fixes \<tau>::\<tau> and \<Theta>::\<Theta> and \<Phi>::\<Phi> and ft :: fun_typ_q
   assumes "Some (AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f" and "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi>"
   shows "supp s \<subseteq> {atom x, atom bv}"
 proof -
 
   have "AF_fundef f  (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s)) \<in> set \<Phi>" using lookup_fun_member assms by auto
   hence *:"\<Theta> ; \<Phi>  ; {|bv|} \<turnstile>\<^sub>w\<^sub>f (AF_fun_typ x b c \<tau> s)" using assms wfPhi_f_poly_wf by simp
   
   thus ?thesis using wfFT_wf_aux[OF *]  using supp_at_base by auto
 qed
 
 lemmas wfPhi_f_supp = wfPhi_f_poly_supp_b wfPhi_f_simple_supp_b wfPhi_f_poly_supp_c 
     wfPhi_f_simple_supp_t wfPhi_f_poly_supp_t wfPhi_f_simple_supp_t wfPhi_f_poly_wfT wfPhi_f_simple_wfT 
     wfPhi_f_poly_supp_s wfPhi_f_simple_supp_s
 
 lemma fun_typ_eq_ret_unique: 
   assumes "(AF_fun_typ x1 b1 c1 \<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \<tau>2' s2')"
   shows  "\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v"
 proof -
   have "[[atom x1]]lst. \<tau>1' = [[atom x2]]lst. \<tau>2'" using assms lst_fst fun_typ.eq_iff lst_snd by metis
   thus ?thesis using subst_v_flip_eq_two[of x1 \<tau>1' x2 \<tau>2' v] subst_v_\<tau>_def by metis
 qed
 
 lemma fun_typ_eq_body_unique: 
   fixes v::v and x1::x and x2::x and s1'::s and s2'::s
   assumes "(AF_fun_typ x1 b1 c1 \<tau>1' s1') =  (AF_fun_typ x2 b2 c2 \<tau>2' s2')"
   shows  "s1'[x1::=v]\<^sub>s\<^sub>v = s2'[x2::=v]\<^sub>s\<^sub>v"
 proof -
   have "[[atom x1]]lst. s1' = [[atom x2]]lst. s2'" using assms lst_fst fun_typ.eq_iff lst_snd by metis
   thus ?thesis using subst_v_flip_eq_two[of x1 s1' x2 s2' v] subst_v_s_def by metis
 qed
 
 lemma fun_ret_unique:
   assumes "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
   shows "\<tau>1'[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[x2::=v]\<^sub>\<tau>\<^sub>v"
 proof -
   have *: " (AF_fundef f (AF_fun_typ_none (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_none (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" using option.inject assms by metis
   thus ?thesis using fun_typ_eq_ret_unique fun_def.eq_iff fun_typ_q.eq_iff by metis
 qed
 
 lemma fun_poly_arg_unique:
   fixes bv1::bv and bv2::bv and b::b and \<tau>1::\<tau> and \<tau>2::\<tau>
   assumes "[[atom bv1]]lst. (AF_fun_typ x1 b1 c1 \<tau>1 s1) = [[atom bv2]]lst. (AF_fun_typ x2 b2 c2 \<tau>2 s2)" (is "[[atom ?x]]lst. ?a = [[atom ?y]]lst. ?b")
   shows "\<lbrace> x1 : b1[bv1::=b]\<^sub>b\<^sub>b | c1[bv1::=b]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x2 : b2[bv2::=b]\<^sub>b\<^sub>b | c2[bv2::=b]\<^sub>c\<^sub>b \<rbrace>" 
 proof -
   obtain c::bv where *:"atom c \<sharp> (b,b1,b2,c1,c2) \<and> atom c \<sharp> (bv1, bv2, AF_fun_typ x1 b1 c1 \<tau>1 s1, AF_fun_typ x2 b2 c2 \<tau>2 s2)" using obtain_fresh fresh_Pair by metis
   hence "(bv1 \<leftrightarrow> c) \<bullet> AF_fun_typ x1 b1 c1 \<tau>1 s1 = (bv2 \<leftrightarrow> c) \<bullet> AF_fun_typ x2 b2 c2 \<tau>2 s2" using  Abs1_eq_iff_all(3)[of ?x ?a ?y ?b] assms by metis
   hence "AF_fun_typ x1 ((bv1 \<leftrightarrow> c) \<bullet> b1) ((bv1 \<leftrightarrow> c) \<bullet> c1) ((bv1 \<leftrightarrow> c) \<bullet> \<tau>1) ((bv1 \<leftrightarrow> c) \<bullet> s1) = AF_fun_typ x2 ((bv2 \<leftrightarrow> c) \<bullet> b2) ((bv2 \<leftrightarrow> c) \<bullet> c2) ((bv2 \<leftrightarrow> c) \<bullet> \<tau>2) ((bv2 \<leftrightarrow> c) \<bullet> s2)" 
     using fun_typ_flip by metis    
   hence **:"\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1) | ((bv1 \<leftrightarrow> c) \<bullet> c1) \<rbrace> = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2) | ((bv2 \<leftrightarrow> c) \<bullet> c2) \<rbrace>" (is "\<lbrace> x1 : ?b1 | ?c1 \<rbrace> = \<lbrace> x2 : ?b2 | ?c2 \<rbrace>") using fun_arg_unique_aux by metis
   hence "\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1) | ((bv1 \<leftrightarrow> c) \<bullet> c1) \<rbrace>[c::=b]\<^sub>\<tau>\<^sub>b = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2) | ((bv2 \<leftrightarrow> c) \<bullet> c2) \<rbrace>[c::=b]\<^sub>\<tau>\<^sub>b" by metis
   hence "\<lbrace> x1 :((bv1 \<leftrightarrow> c) \<bullet> b1)[c::=b]\<^sub>b\<^sub>b | ((bv1 \<leftrightarrow> c) \<bullet> c1)[c::=b]\<^sub>c\<^sub>b \<rbrace> = \<lbrace> x2 : ((bv2 \<leftrightarrow> c) \<bullet> b2)[c::=b]\<^sub>b\<^sub>b | ((bv2 \<leftrightarrow> c) \<bullet> c2)[c::=b]\<^sub>c\<^sub>b \<rbrace>" using subst_tb.simps by metis  
   thus ?thesis using *  flip_subst_subst subst_b_c_def subst_b_b_def fresh_prodN flip_commute by metis
 qed
 
 lemma fun_poly_ret_unique:
   assumes "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
   shows "\<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b[x1::=v]\<^sub>\<tau>\<^sub>v = \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b[x2::=v]\<^sub>\<tau>\<^sub>v"
 proof -
   have *: " (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" using option.inject assms by metis
   hence "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')" 
       (is "AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2") using fun_def.eq_iff by metis
   hence **:"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2" using fun_typ_q.eq_iff(1) by metis
 
   hence *:"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b" using subst_b_flip_eq_two subst_b_fun_typ_def by metis
   have "[[atom x1]]lst. \<tau>1'[bv1::=b]\<^sub>\<tau>\<^sub>b = [[atom x2]]lst. \<tau>2'[bv2::=b]\<^sub>\<tau>\<^sub>b" 
     apply(rule lst_snd[of _ "c1[bv1::=b]\<^sub>c\<^sub>b" _ _ "c2[bv2::=b]\<^sub>c\<^sub>b"])
     apply(rule lst_fst[of _ _ "s1'[bv1::=b]\<^sub>s\<^sub>b" _ _ "s2'[bv2::=b]\<^sub>s\<^sub>b"])
     using *  subst_ft_b.simps fun_typ.eq_iff by metis
   thus ?thesis using subst_v_flip_eq_two subst_v_\<tau>_def by metis
 qed
 
 lemma fun_poly_body_unique:
   assumes "Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = lookup_fun \<Phi> f" and "Some (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2'))) = lookup_fun \<Phi> f"
   shows "s1'[bv1::=b]\<^sub>s\<^sub>b[x1::=v]\<^sub>s\<^sub>v = s2'[bv2::=b]\<^sub>s\<^sub>b[x2::=v]\<^sub>s\<^sub>v"
 proof - 
   have *: " (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1'))) = (AF_fundef f (AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')))" 
     using option.inject assms by metis
   hence "AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1' s1') = AF_fun_typ_some bv2 (AF_fun_typ x2 b2 c2 \<tau>2' s2')" 
       (is "AF_fun_typ_some bv1 ?ft1 = AF_fun_typ_some bv2 ?ft2") using fun_def.eq_iff by metis
   hence **:"[[atom bv1]]lst. ?ft1 = [[atom bv2]]lst. ?ft2" using fun_typ_q.eq_iff(1) by metis
 
   hence *:"subst_ft_b ?ft1 bv1 b = subst_ft_b ?ft2 bv2 b" using subst_b_flip_eq_two subst_b_fun_typ_def by metis
   have "[[atom x1]]lst. s1'[bv1::=b]\<^sub>s\<^sub>b = [[atom x2]]lst. s2'[bv2::=b]\<^sub>s\<^sub>b" 
     using lst_snd lst_fst subst_ft_b.simps fun_typ.eq_iff 
     by (metis "local.*")
 
   thus ?thesis using subst_v_flip_eq_two subst_v_s_def by metis
 qed
 
 lemma funtyp_eq_iff_equalities:
   fixes s'::s and s::s
   assumes " [[atom x']]lst. ((c', \<tau>'), s') = [[atom x]]lst. ((c, \<tau>), s)" 
   shows "\<lbrace> x' : b  | c' \<rbrace> = \<lbrace> x : b  | c \<rbrace> \<and>  s'[x'::=v]\<^sub>s\<^sub>v = s[x::=v]\<^sub>s\<^sub>v \<and> \<tau>'[x'::=v]\<^sub>\<tau>\<^sub>v = \<tau>[x::=v]\<^sub>\<tau>\<^sub>v"
 proof - 
   have  "[[atom x']]lst. s' = [[atom x]]lst. s" and "[[atom x']]lst. \<tau>' = [[atom x]]lst. \<tau>" and
            " [[atom x']]lst. c' = [[atom x]]lst. c" using lst_snd lst_fst assms by metis+
   thus ?thesis using   subst_v_flip_eq_two  \<tau>.eq_iff 
     by (metis assms fun_typ.eq_iff fun_typ_eq_body_unique fun_typ_eq_ret_unique)
 qed
 
 section \<open>Weakening\<close>
 
 lemma wfX_wfB1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B>::\<B> and \<Phi>::\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
            and cs::branch_s and css::branch_list
   shows  wfV_wfB: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" and     
          "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> True" and
          "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma> \<Longrightarrow>   True" and
          wfT_wfB: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow>  \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b_of \<tau> " and
          "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow> True" and     
          "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow>  True" and       
          wfCE_wfB: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
 proof(induct   rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.inducts)
  case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
   hence "(x,b,c) \<in> toSet \<Gamma>" using lookup_iff wfV_wf  using lookup_in_g by presburger
   hence "b \<in> fst`snd`toSet \<Gamma>" by force
   hence "wfB \<Theta> \<B> b" using wfG_wfB wfV_varI by metis
   then show ?case using wfV_elims wfG_wf  wf_intros by metis
 next
   case (wfV_litI \<Theta> \<Gamma> l)
   moreover have "wfTh \<Theta>" using wfV_wf wfG_wf wfV_litI by metis
   ultimately  show ?case using wfV_wf wfG_wf  wf_intros base_for_lit.simps l.exhaust by metis
 next
   case (wfV_pairI \<Theta> \<Gamma> v1 b1 v2 b2)
    then show ?case using  wfG_wf  wf_intros by metis
 next
   case (wfV_consI s dclist \<Theta> dc x b c B \<Gamma> v)
   then show ?case
     using wfV_wf wfG_wf   wfB_consI by metis  
 next
   case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
   then show ?case
     using wfV_wf wfG_wf  using wfB_appI by metis
 next
   case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
   then show ?case using wfB_elims by auto
 next
   case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using wfB_elims by auto
 next
   case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
 next
   case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
   then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
 next
   case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
   then show ?case using  wfB_elims by metis
 next
   case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
   then show ?case using wfB_elims by metis
 next
   case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using wfB_elims by auto
 next
   case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
   then show ?case using  wfV_wf wfG_wf  wf_intros wfX_wfY by metis
 qed(auto | metis wfV_wf wfG_wf  wf_intros )+
 
 lemma wfX_wfB2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and b::b and \<B>::\<B> and \<Phi>::\<Phi> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
            and cs::branch_s and css::branch_list
   shows
          wfE_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b"  and
          wfS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
          wfCS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and
          wfCSS_wfB: "\<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" and     
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow>  True" and   
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow> \<B> |\<subseteq>| \<B>' \<Longrightarrow> \<Theta> ; \<Phi>  ; \<B>' \<turnstile>\<^sub>w\<^sub>f ft" 
 proof(induct   rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.inducts) 
   case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   then show ?case using wfB_elims wfX_wfB1 by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wfB_elims wfX_wfB1 by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   then show ?case using wfB_boolI  wfX_wfY by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wfB_elims wfX_wfB1 by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wfB_elims wfX_wfB1 by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wfB_elims wfX_wfB1 by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wfB_elims wfX_wfB1 
     using wfB_pairI by auto
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   then show ?case using wfB_elims wfX_wfB1 
     using wfB_intI wfX_wfY1(1) by auto
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
   hence "\<Theta>; \<B>;(x,b,c) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfPhi_f_simple_wfT wfT_b_weakening by fast
   then show ?case using b_of.simps using wfT_b_weakening
      by (metis b_of.cases bot.extremum wfT_elims(2))
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
   hence "\<Theta> ; {| bv |} ;(x,b,c) #\<^sub>\<Gamma> GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  using wfPhi_f_poly_wfT wfX_wfY by blast
   then show ?case using wfE_appPI b_of.simps using wfT_b_weakening wfT_elims  wfT_subst_wfB subst_b_b_def  by metis
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   hence "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<tau>" using wfD_wfT by fast
   then show ?case using wfT_elims b_of.simps by metis
 next
   case (wfFTNone \<Theta> ft)
   then show ?case by auto
 next
   case (wfFTSome \<Theta> bv ft)
   then show ?case by auto
 next
   case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   then show ?case using wfX_wfB1 
     using wfB_unitI wfX_wfY2(5) by auto
 next
   case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dc t cs b dclist css)
   then show ?case using wfX_wfB1 by auto      
 next
   case (wfD_emptyI \<Theta> \<B> \<Gamma>)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfPhi_emptyI \<Theta>)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfPhi_consI f \<Theta> \<Phi> ft)
   then show ?case using wfX_wfB1 by auto
 next
   case (wfFTI \<Theta> B b \<Phi> x c s \<tau>)
   then show ?case using wfX_wfB1 
     by (meson Wellformed.wfFTI wb_b_weakening2(8))
 qed(metis wfV_wf wfG_wf  wf_intros wfX_wfB1)
 
 lemmas wfX_wfB = wfX_wfB1 wfX_wfB2
 
 lemma wf_weakening1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list
 
   shows  wfV_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b" and
          wfC_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>'  \<Longrightarrow> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  c" and
          "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<Longrightarrow>  True" and
          wfT_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts  \<Longrightarrow>  True" and 
          "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True " and
          wfB_weakening: "wfB \<Theta> \<B> b \<Longrightarrow>  \<B> |\<subseteq>| \<B>' \<Longrightarrow> wfB \<Theta> \<B> b" and 
          wfCE_weakening: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ce : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>' \<turnstile>\<^sub>w\<^sub>f ce : b"  and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow> True"
 proof(nominal_induct
           b and c and \<Gamma> and \<tau> and ts and P and b and b and td 
           avoiding:  \<Gamma>'          
           rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
  case (wfV_varI \<Theta> \<B> \<Gamma> b c x)
   hence "Some (b, c) = lookup \<Gamma>' x" using  lookup_weakening  by metis
   then show ?case using Wellformed.wfV_varI wfV_varI by metis
 next
   case (wfTI z \<Theta> \<B>  \<Gamma>  b c)  (* This proof pattern is used elsewhere when proving weakening for typing predicates *)
   show ?case proof
     show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> using wfTI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfTI by auto
     have *:"toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps wfTI by auto
     thus  \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfTI(8)[OF _ *] wfTI wfX_wfY
       by (simp add: wfG_cons_TRUE)
   qed
 next
   case (wfV_conspI s bv dclist \<Theta> dc x b' c \<B> b \<Gamma> v)
   show ?case proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
     show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
     show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>', b, v)\<close> using wfV_conspI by simp
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
   qed
 qed(metis wf_intros)+
 
 lemma wf_weakening2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list
   shows 
          wfE_weakening: "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b" and
          wfS_weakening: "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma>' ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma>' ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
          wfD_weakning: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<Longrightarrow> toSet \<Gamma> \<subseteq> toSet \<Gamma>' \<Longrightarrow>  \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f  \<Delta>" and       
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True" 
 proof(nominal_induct
           b and b and b and b and \<Phi> and \<Delta> and ftq and ft
           avoiding:  \<Gamma>'          
           rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
   show ?case proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
     show \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close> using wfE_appPI by auto
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close> using wfE_appPI wf_weakening1 by auto
   qed
 next                          
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   show ?case proof(rule)
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
     have "toSet ((x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_letI by auto
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_letI by (meson wfG_cons wfG_cons_TRUE wfS_wf)
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close>  using wfS_letI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, e, b)\<close>  using wfS_letI by auto
   qed
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   show ?case proof
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
     show \<open> \<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close>  using wfS_let2I wf_weakening1 by auto
     have "toSet ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_let2I by auto
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s2 : b \<close>  using wfS_let2I    by (meson wfG_cons wfG_cons_TRUE wfS_wf)
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, s1, b, \<tau>)\<close>  using wfS_let2I by auto
   qed
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   show ?case proof
     show "\<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f \<tau> " using wfS_varI wf_weakening1 by auto
     show "\<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> "  using wfS_varI wf_weakening1 by auto
     show "atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, \<tau>, v, b)"  using wfS_varI by auto
     show "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>' ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta>  \<turnstile>\<^sub>w\<^sub>f s : b "  using wfS_varI by auto
   qed
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau>  \<Gamma> \<Delta> s b tid dc)
   show ?case proof
     have "toSet ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>) \<subseteq> toSet  ((x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>')"  using wfS_branchI by auto
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI  by (meson wfG_cons wfG_cons_TRUE wfS_wf)
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, \<Gamma>', \<tau>)\<close> using wfS_branchI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_branchI by auto
   qed
 next
   case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
   then show ?case using wf_intros by metis
 next
   case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
   then show ?case using wf_intros by metis
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case proof(rule)
     show \<open> \<Theta>; \<B>; \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI wf_weakening1 by auto
     have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>'" proof(rule wfG_consI)
       show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<close> using wfS_assertI by auto
       show \<open>atom x \<sharp> \<Gamma>'\<close> using wfS_assertI by auto
       show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f B_bool \<close> using wfS_assertI wfB_boolI wfX_wfY by metis
       have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>'" proof
         show "(TRUE) \<in> {TRUE, FALSE}" by auto
         show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' \<close> using wfS_assertI by auto
         show \<open>atom x \<sharp> \<Gamma>'\<close> using wfS_assertI by auto
         show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f B_bool \<close> using wfS_assertI wfB_boolI wfX_wfY by metis
       qed
       thus  \<open> \<Theta>; \<B>; (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>' \<turnstile>\<^sub>w\<^sub>f c \<close> 
        using  wf_weakening1(2)[OF \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f c \<close>  \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, TRUE) #\<^sub>\<Gamma> \<Gamma>' \<close>] by force
     qed  
     thus  \<open> \<Theta>; \<Phi>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>' ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI by fastforce   
     show \<open> \<Theta>; \<B>; \<Gamma>' \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfS_assertI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>', \<Delta>, c, b, s)\<close> using wfS_assertI by auto
   qed
 qed(metis wf_intros wf_weakening1)+
 
 lemmas wf_weakening = wf_weakening1 wf_weakening2
 
 lemma wfV_weakening_cons:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and c::c
   assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b"  and "atom y \<sharp> \<Gamma>" and "\<Theta>; \<B>; ((y,b',TRUE) #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f c" 
   shows "\<Theta>; \<B>; (y,b',c) #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f  v : b"
 proof -
   have "wfG \<Theta> \<B> ((y,b',c) #\<^sub>\<Gamma>\<Gamma>)" using wfG_intros2 assms by auto
   moreover have "toSet \<Gamma> \<subseteq> toSet ((y,b',c) #\<^sub>\<Gamma>\<Gamma>)" using toSet.simps by auto
   ultimately show ?thesis using wf_weakening  using assms(1) by blast
 qed
 
 lemma wfG_cons_weakening:
   fixes \<Gamma>'::\<Gamma>
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" and  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "atom x \<sharp> \<Gamma>'"
   shows  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f ((x, b, c)  #\<^sub>\<Gamma> \<Gamma>')"
 proof(cases "c \<in> {TRUE,FALSE}")
   case True
   then show ?thesis using wfG_wfB  wfG_cons2I assms by auto
 next
   case False
   hence *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>  \<and> atom x \<sharp> \<Gamma> \<and>  \<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c" 
     using  wfG_elims(2)[OF assms(1)] by auto
   have a1:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" using wfG_wfB wfG_cons2I assms by simp
   moreover have a2:"toSet ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> ) \<subseteq> toSet ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps assms by blast
   moreover have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" proof
     show "(TRUE) \<in> {TRUE, FALSE}" by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" using assms by auto
     show "atom x \<sharp> \<Gamma>'" using assms by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfG_elims by metis
   qed  
   hence " \<Theta>; \<B>;  (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f c" using wf_weakening  a1 a2 * by auto
   then show ?thesis using wfG_cons1I[of c \<Theta> \<B> \<Gamma>' x b, OF False ] wfG_wfB assms by simp
 qed
 
 lemma wfT_weakening_aux:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and c::c
   assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>"  and "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "atom z \<sharp> \<Gamma>'"
   shows "\<Theta>; \<B>; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<lbrace> z : b | c \<rbrace>" 
 proof 
   show \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>')\<close> 
     using wf_supp wfX_wfY assms fresh_prodN fresh_def x_not_in_b_set wfG_fresh_x by metis
   show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using assms wfT_elims by metis
   show \<open> \<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'   \<turnstile>\<^sub>w\<^sub>f c \<close> proof - 
     have *:"\<Theta>; \<B>; (z,b,TRUE) #\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c" using wfT_wfC fresh_weakening assms by auto
     moreover have a1:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'" using wfG_cons2I assms \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  b\<close> by simp
     moreover have a2:"toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> ) \<subseteq> toSet ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>')" using toSet.simps assms by blast
     moreover have " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>' " proof
       show "(TRUE) \<in> {TRUE, FALSE}" by auto
       show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'" using assms by auto
       show "atom z \<sharp> \<Gamma>'" using assms by auto
       show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfT_elims by metis
     qed  
     thus ?thesis  using wf_weakening a1 a2 * by auto
   qed    
 qed
 
 lemma wfT_weakening_all:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and \<tau>::\<tau>
   assumes "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>"  and "\<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" and "toSet \<Gamma> \<subseteq> toSet \<Gamma>'" and "\<B> |\<subseteq>| \<B>'" 
   shows "\<Theta>; \<B>' ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<tau>" 
   using wb_b_weakening assms wfT_weakening by metis
 
 lemma wfT_weakening_nil:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and \<tau>::\<tau>
   assumes "\<Theta> ; {||} ; GNil  \<turnstile>\<^sub>w\<^sub>f \<tau>"  and "\<Theta>; \<B>' \<turnstile>\<^sub>w\<^sub>f  \<Gamma>'" 
   shows "\<Theta>; \<B>' ; \<Gamma>'  \<turnstile>\<^sub>w\<^sub>f  \<tau>" 
   using wfT_weakening_all
   using assms(1) assms(2) toSet.simps(1) by blast
 
 lemma wfTh_wfT2: 
   fixes x::x and v::v and \<tau>::\<tau> and G::\<Gamma>
   assumes "wfTh \<Theta>" and "AF_typedef s dclist \<in> set \<Theta>" and 
       "(dc, \<tau>) \<in> set dclist"  and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f G"
   shows "supp \<tau> = {}" and "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>" and "wfT \<Theta> B G \<tau>"
 proof -
   show  "supp \<tau> = {}" proof(rule ccontr)
     assume a1: "supp \<tau> \<noteq> {}"
     have  "supp \<Theta> \<noteq> {}" proof -
       obtain dclist where dc: "AF_typedef s dclist \<in> set \<Theta> \<and> (dc, \<tau>) \<in> set dclist" 
         using assms  by auto
       hence "supp (dc,\<tau>)  \<noteq> {}" 
         using a1  by (simp add: supp_Pair)
       hence "supp dclist  \<noteq> {}" using dc supp_list_member by auto
       hence "supp (AF_typedef s dclist) \<noteq> {}"  using type_def.supp by auto
       thus ?thesis using supp_list_member dc by auto
     qed
     thus False using assms wfTh_supp by simp
   qed
   thus "\<tau>[x::=v]\<^sub>\<tau>\<^sub>v = \<tau>"  by (simp add: fresh_def)
   have "wfT \<Theta> {||} GNil \<tau>" using assms wfTh_wfT by auto
   thus "wfT \<Theta> B G \<tau>" using assms wfT_weakening_nil by simp
 qed
 
 lemma wf_d_weakening:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and s::s and \<B>::\<B> and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
          and cs::branch_s and css::branch_list
   shows 
          "\<Theta>; \<Phi>; \<B>; \<Gamma>  ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f e : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow> \<Theta>; \<Phi>; \<B>;  \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>  \<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta>' ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b" and
          "\<Theta> ; \<Phi> ; \<B>  ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<Longrightarrow> setD \<Delta> \<subseteq> setD \<Delta>' \<Longrightarrow>   \<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta>' ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b" and       
          "\<Theta> \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow> True" and        
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
 proof(nominal_induct
           b and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
           avoiding:  \<Delta>'         
        rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   then show ?case using wf_intros by metis
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_intros by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_intros by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_intros by metis
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   then show ?case using wf_intros by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
   then show ?case using wf_intros by metis
 next
    case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv v \<tau> f x b c s)
    show ?case proof(rule, (rule wfE_appPI)+)
     show \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>  using wfE_appPI by auto
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x b c \<tau> s))) = lookup_fun \<Phi> f\<close>  using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b[bv::=b']\<^sub>b \<close>  using wfE_appPI by auto
   qed
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   show ?case proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_mvarI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfE_mvarI by auto
     show \<open>(u, \<tau>) \<in> setD \<Delta>'\<close> using wfE_mvarI by auto
   qed
 next
   case (wfS_valI \<Theta> \<Phi> \<B> \<Gamma> v b \<Delta>)
   then show ?case using wf_intros by metis
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b' x s b)
   show ?case proof(rule)
     show \<open> \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>' \<turnstile>\<^sub>w\<^sub>f e : b' \<close> using wfS_letI by auto
     have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_letI by metis
     hence "\<Theta>; \<B>; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_letI by force
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b', TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_letI by metis
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_letI by auto
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', e, b)\<close> using wfS_letI by auto
   qed
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case proof
     have "\<Theta>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" proof(rule  wf_weakening2(6))
       show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assertI by auto
     next
       show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> \<close> using wfS_assertI wfX_wfY by metis
     next
       show \<open>toSet \<Gamma> \<subseteq> toSet ((x, B_bool, c) #\<^sub>\<Gamma> \<Gamma>)\<close> using wfS_assertI by auto
     qed
     thus  \<open> \<Theta>; \<Phi>; \<B>; (x, B_bool, c) #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_assertI wfX_wfY by metis
   next
     show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c \<close> using wfS_assertI by auto
   next
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assertI by auto
   next
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', c, b, s)\<close> using wfS_assertI by auto
   qed
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> x s2 b)
   show ?case proof
     show \<open> \<Theta>; \<Phi>; \<B>; \<Gamma>; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s1 : b_of \<tau> \<close> using wfS_let2I by auto
     show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_let2I by auto
     have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_let2I by metis
     hence "\<Theta>; \<B>; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_let2I by force
     thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s2 : b \<close> using  wfS_let2I by metis
     show \<open>atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', s1, b,\<tau>)\<close> using wfS_let2I by auto
   qed
 next
   case (wfS_ifI \<Theta> \<B> \<Gamma> v \<Phi> \<Delta> s1 b s2)
   then show ?case using wf_intros by metis
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   show ?case proof
     show \<open> \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<tau> \<close> using wfS_varI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close>  using wfS_varI by auto
     show \<open>atom u \<sharp>  (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', \<tau>, v, b)\<close>  using wfS_varI setD.simps by auto
     have "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f (u, \<tau>)  #\<^sub>\<Delta> \<Delta>'" using wfS_varI wfD_cons setD.simps u_fresh_d by metis 
     thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma> ; (u, \<tau>)  #\<^sub>\<Delta> \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close>  using wfS_varI setD.simps by blast
   qed
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   show ?case proof
     show \<open>(u, \<tau>) \<in> setD \<Delta>'\<close> using wfS_assignI setD.simps by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_assignI by auto
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfS_assignI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b_of \<tau> \<close> using wfS_assignI by auto
   qed
 next
   case (wfS_whileI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using wf_intros by metis
 next
   case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using wf_intros by metis
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   then show ?case using wf_intros by metis
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> x \<tau> \<Gamma> \<Delta> s b tid dc)
   show ?case proof
     have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons2I wfX_wfY wfS_branchI by metis
     hence "\<Theta>; \<B>; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>'" using wf_weakening2(6) wfS_branchI by force
     thus  \<open> \<Theta> ; \<Phi>  ; \<B> ; (x, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma> ; \<Delta>' \<turnstile>\<^sub>w\<^sub>f s : b \<close> using wfS_branchI by simp
     show \<open> atom x \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>, \<Delta>', \<Gamma>, \<tau>)\<close> using wfS_branchI by auto
     show \<open> \<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta>' \<close> using wfS_branchI by auto
   qed
 next
   case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
   then show ?case using wf_intros by metis
 next
   case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
   then show ?case using wf_intros by metis
 qed(auto+)
 
 section \<open>Useful well-formedness instances\<close>
 
 text \<open>Well-formedness for particular constructs that we will need later\<close>
 
 lemma wfC_e_eq:
   fixes ce::ce and \<Gamma>::\<Gamma>
   assumes "\<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and "atom x \<sharp> \<Gamma> "
   shows "\<Theta> ;  \<B> ; ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)  \<turnstile>\<^sub>w\<^sub>f (CE_val (V_var x)  ==  ce )"
 proof - 
   have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using assms wfX_wfB by auto
   hence wbg: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using wfX_wfY assms by auto
   show ?thesis proof
     show *:"\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b"
     proof(rule)     
       show "\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f V_var x : b " proof
         show "\<Theta>  ;  \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> " using wfG_cons2I wfX_wfY assms \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b\<close> by auto
         show "Some (b, TRUE) = lookup ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>) x" using lookup.simps by auto
       qed
     qed
     show "\<Theta> ;  \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f ce : b"
       using assms wf_weakening1(8)[OF assms(1), of "(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> "] * toSet.simps wfX_wfY
       by (metis Un_subset_iff equalityE)
   qed
 qed
 
 lemma wfC_e_eq2:
   fixes e1::ce and e2::ce
   assumes  "\<Theta>  ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e1 : b"  and  "\<Theta>  ; \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b"  and " \<turnstile>\<^sub>w\<^sub>f \<Theta>" and "atom x \<sharp> \<Gamma>"
   shows "\<Theta>; \<B>; (x, b, (CE_val (V_var x)) == e1)   #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f  (CE_val (V_var x)) == e2 "
 proof(rule wfC_eqI)
   have *: "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>" proof(rule wfG_cons1I )
     show "(CE_val (V_var x)  ==  e1 ) \<notin> {TRUE, FALSE}" by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>" using assms wfX_wfY by metis
     show *:"atom x \<sharp> \<Gamma>" using assms by auto
     show "\<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x)  ==  e1" using wfC_e_eq assms * by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b" using assms wfX_wfB by auto
   qed
   show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f CE_val (V_var x) : b" using assms * wfCE_valI wfV_varI by auto
   show "\<Theta>; \<B>; (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b" proof(rule wf_weakening1(8))
     show "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f e2 : b " using assms by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>" using * by auto
     show "toSet \<Gamma> \<subseteq> toSet ((x, b, CE_val (V_var x)  ==  e1 )  #\<^sub>\<Gamma> \<Gamma>)" by auto
   qed
 qed
 
 lemma wfT_wfT_if_rev:
   assumes "wfV P \<B> \<Gamma> v  (base_for_lit l)" and "wfT P \<B> \<Gamma> t" and \<open>atom z1 \<sharp> \<Gamma>\<close>
   shows "wfT P \<B> \<Gamma> (\<lbrace> z1 : b_of t  | CE_val v  ==  CE_val (V_lit l) IMP  (c_of t z1)  \<rbrace>)"
 proof
   show \<open> P; \<B>  \<turnstile>\<^sub>w\<^sub>f b_of t \<close> using wfX_wfY assms by meson
   have wfg: " P; \<B>  \<turnstile>\<^sub>w\<^sub>f  (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>" using assms wfV_wf  wfG_cons2I wfX_wfY 
     by (meson wfG_cons_TRUE)
   show \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of t z1  \<close> proof
     show *: \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e  ==  [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e  \<close> 
     proof(rule wfC_eqI[where b="base_for_lit l"])
       show "P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ v ]\<^sup>c\<^sup>e : base_for_lit l" 
         using assms wf_intros wf_weakening wfg   by (meson wfV_weakening_cons)
       show "P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f [ [ l ]\<^sup>v ]\<^sup>c\<^sup>e : base_for_lit l" using wfg assms wf_intros wf_weakening wfV_weakening_cons by meson
     qed    
     have " t = \<lbrace> z1 : b_of t | c_of t z1 \<rbrace>" using c_of_eq 
       using assms(2) assms(3) b_of_c_of_eq wfT_x_fresh by auto
     thus  \<open> P; \<B> ; (z1, b_of t, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c_of t z1 \<close> using wfT_wfC assms wfG_elims * by simp
   qed
   show \<open>atom z1 \<sharp>  (P, \<B>, \<Gamma>)\<close> using assms wfG_fresh_x wfX_wfY by metis
 qed
 
 lemma wfT_eq_imp:
   fixes zz::x and ll::l and \<tau>'::\<tau>
   assumes "base_for_lit ll = B_bool" and "\<Theta> ; {||} ; GNil \<turnstile>\<^sub>w\<^sub>f \<tau>'" and
           "\<Theta> ; {||} \<turnstile>\<^sub>w\<^sub>f (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil" and "atom zz \<sharp> x"
   shows "\<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma>
                  GNil   \<turnstile>\<^sub>w\<^sub>f \<lbrace> zz : b_of \<tau>'  | [ [ x ]\<^sup>v ]\<^sup>c\<^sup>e  ==  [ [ ll ]\<^sup>v ]\<^sup>c\<^sup>e   IMP  c_of \<tau>' zz  \<rbrace>"
 proof(rule wfT_wfT_if_rev)
   show \<open> \<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil \<turnstile>\<^sub>w\<^sub>f [ x ]\<^sup>v : base_for_lit ll \<close> 
     using wfV_varI lookup.simps base_for_lit.simps assms by simp
   show \<open> \<Theta> ; {||} ; (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>' \<close> 
     using wf_weakening assms toSet.simps by auto
   show \<open>atom zz \<sharp> (x, b_of \<lbrace> z' : B_bool  | TRUE \<rbrace>, c_of \<lbrace> z' : B_bool  | TRUE \<rbrace> x)  #\<^sub>\<Gamma> GNil\<close> 
     unfolding fresh_GCons fresh_prod3 b_of.simps c_of_true 
     using x_fresh_b fresh_GNil   c_of_true c.fresh assms by metis
 qed
 
 lemma wfC_v_eq:
   fixes ce::ce and \<Gamma>::\<Gamma> and v::v
   assumes "\<Theta> ;  \<B> ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b" and "atom x \<sharp> \<Gamma> "
   shows "\<Theta> ;  \<B> ; ((x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)  \<turnstile>\<^sub>w\<^sub>f (CE_val (V_var x)  ==  CE_val v )"
   using wfC_e_eq wfCE_valI assms wfX_wfY  by auto
 
 lemma wfT_e_eq:
   fixes ce::ce
   assumes "\<Theta> ;  \<B> ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b" and "atom z \<sharp> \<Gamma>"
   shows "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | CE_val (V_var z) == ce \<rbrace>"
 proof
   show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfX_wfB assms by auto
   show " atom z \<sharp> (\<Theta>, \<B>, \<Gamma>)" using assms wfG_fresh_x wfX_wfY by metis
   show "\<Theta> ;  \<B> ; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f CE_val (V_var z)  ==  ce "
     using wfTI wfC_e_eq assms wfTI by auto
 qed
 
 lemma wfT_v_eq:
   assumes " wfB \<Theta> \<B> b" and "wfV  \<Theta> \<B> \<Gamma> v b" and "atom z \<sharp> \<Gamma>"
   shows "wfT \<Theta> \<B> \<Gamma> \<lbrace> z : b | C_eq (CE_val (V_var z)) (CE_val v)\<rbrace>"
   using wfT_e_eq wfE_valI assms wfX_wfY 
   by (simp add: wfCE_valI)
 
 lemma wfC_wfG:
   fixes \<Gamma>::\<Gamma> and c::c and b::b
   assumes "\<Theta> ; B ; \<Gamma> \<turnstile>\<^sub>w\<^sub>f c" and "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b" and "atom x \<sharp> \<Gamma>" 
   shows "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f (x,b,c)#\<^sub>\<Gamma> \<Gamma>" 
 proof - 
   have " \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I assms wfX_wfY by fast
   hence " \<Theta> ; B ; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c " using wfC_weakening assms by force
   thus ?thesis using wfG_consI assms wfX_wfY by metis
 qed
 
 section \<open>Replacing the constraint on a variable in a context\<close>
 
 lemma wfG_cons_fresh2:
   fixes \<Gamma>'::\<Gamma>
   assumes "wfG P \<B> (( (x',b',c')  #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>))"
   shows "x'\<noteq>x" 
 proof - 
   have "atom x' \<sharp> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" 
     using assms wfG_elims(2) by blast
   thus ?thesis 
     using  fresh_gamma_append[of "atom x'" \<Gamma>' "(x, b, c)  #\<^sub>\<Gamma> \<Gamma>"] fresh_GCons fresh_prod3[of "atom x'" x b c] by auto
 qed
 
 lemma replace_in_g_inside:
   fixes \<Gamma>::\<Gamma>
   assumes "wfG P \<B> (\<Gamma>'@((x,b0,c0') #\<^sub>\<Gamma>\<Gamma>))" 
   shows "replace_in_g (\<Gamma>'@((x,b0,c0') #\<^sub>\<Gamma>\<Gamma>)) x c0 = (\<Gamma>'@((x,b0,c0) #\<^sub>\<Gamma>\<Gamma>))"
 using assms proof(induct \<Gamma>' rule: \<Gamma>_induct)
   case GNil
   then show ?case using replace_in_g.simps by auto
 next
   case (GCons x' b' c' \<Gamma>'')
   hence "P; \<B> \<turnstile>\<^sub>w\<^sub>f ((x', b', c')  #\<^sub>\<Gamma> (\<Gamma>''@ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma> ))" by simp
   hence "x \<noteq> x'" using  wfG_cons_fresh2 by metis
   then show ?case using replace_in_g.simps GCons  by (simp add: wfG_cons)
 qed
 
 lemma wfG_supp_rig_eq:
   fixes \<Gamma>::\<Gamma>
   assumes  "wfG P \<B> (\<Gamma>'' @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'' @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>)"
   shows "supp (\<Gamma>'' @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B> = supp (\<Gamma>'' @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>"
 using assms proof(induct \<Gamma>'')
   case GNil
   have "supp (GNil @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>  = supp ((x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>" using supp_Cons supp_GNil by auto
   also have "... = supp x \<union> supp b0 \<union> supp c0' \<union> supp \<Gamma> \<union> supp \<B> " using supp_GCons by auto
   also have "... = supp x \<union> supp b0 \<union> supp c0 \<union> supp \<Gamma> \<union> supp \<B> " using GNil wfG_wfC[THEN wfC_supp_cons(2) ] by fastforce
   also have "... =  (supp ((x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>)) \<union> supp \<B> " using supp_GCons by auto
   finally have "supp (GNil @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B> = supp (GNil @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>) \<union> supp \<B>" using supp_Cons supp_GNil by auto
   then show ?case using supp_GCons wfG_cons2 by auto
 next
   case (GCons xbc \<Gamma>1)
   moreover have " (xbc  #\<^sub>\<Gamma> \<Gamma>1) @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>  =  (xbc  #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>))"  by simp
   moreover have " (xbc  #\<^sub>\<Gamma> \<Gamma>1) @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>  =  (xbc  #\<^sub>\<Gamma> (\<Gamma>1 @ (x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>))"  by simp
   ultimately have  "(P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>1 @ ((x, b0, c0)  #\<^sub>\<Gamma> \<Gamma>))  \<and>  P; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>1 @ ((x, b0, c0')  #\<^sub>\<Gamma> \<Gamma>)" using wfG_cons2 by metis
   thus ?case using GCons supp_GCons by auto
 qed
 
 lemma fresh_replace_inside[ms_fresh]:
   fixes y::x and \<Gamma>::\<Gamma>
   assumes  "wfG P \<B> (\<Gamma>'' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)"
   shows "atom y \<sharp> (\<Gamma>'' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) = atom y \<sharp> (\<Gamma>'' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)"
   unfolding fresh_def  using wfG_supp_rig_eq assms x_not_in_b_set by fast
 
 lemma wf_replace_inside1:
   fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
            and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
 
 shows  wfV_replace_inside: "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f v : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f v : b'" and
        wfC_replace_inside: "\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f c'' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  c''" and
        wfG_replace_inside: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>   \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) " and
        wfT_replace_inside: "\<Theta>; \<B>; G \<turnstile>\<^sub>w\<^sub>f \<tau> \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow>  \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f  \<tau>" and
        "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow>  True" and 
        "\<turnstile>\<^sub>w\<^sub>f P \<Longrightarrow> True" and
         "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True" and  
        wfCE_replace_inside: "\<Theta> ;  \<B> ; G  \<turnstile>\<^sub>w\<^sub>f ce : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f ce : b'" and
        "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
 proof(nominal_induct   
           b' and  c'' and G and \<tau> and ts and P and b and b' and td 
       avoiding: \<Gamma>' c'
 rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfV_varI \<Theta> \<B> \<Gamma>2 b2 c2 x2)
   then show ?case using wf_intros by (metis lookup_in_rig_eq lookup_in_rig_neq replace_in_g_inside)
 next
   case (wfV_conspI s bv dclist \<Theta> dc x1 b' c1 \<B> b1 \<Gamma>1 v)
   show ?case proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
     show \<open>(dc, \<lbrace> x1 : b'  | c1 \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     show \<open> \<Theta> ;  \<B>   \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfV_conspI by auto
     show *: \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b1]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
     moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfV_wf wfV_conspI by simp
     ultimately have "atom bv \<sharp> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" unfolding fresh_def using wfV_wf  wfG_supp_rig_eq  wfV_conspI 
       by (metis Un_iff fresh_def)
     thus \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>, b1, v)\<close>  
       unfolding fresh_prodN using fresh_prodN wfV_conspI by metis    
   qed
 next
   case (wfTI z \<Theta> \<B> G  b1 c1)
   show ?case proof
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfTI by auto
 
     have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_consI  wfTI  wfG_cons  wfX_wfY by metis
     moreover hence *:"wfG \<Theta> \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"  using wfX_wfY 
        by (metis append_g.simps(2) wfG_cons2 wfTI.hyps wfTI.prems(1) wfTI.prems(2))
     hence \<open>atom z \<sharp> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>\<close> 
       using fresh_replace_inside[of \<Theta> \<B> \<Gamma>' x b c \<Gamma> c' z,OF *] wfTI wfX_wfY wfG_elims by metis
     thus \<open>atom z \<sharp> (\<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)\<close> using wfG_fresh_x[OF *] by auto 
 
     have "(z, b1, TRUE)  #\<^sub>\<Gamma> G = ((z, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>') @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" 
       using wfTI append_g.simps by metis
     thus \<open> \<Theta>; \<B>; (z, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1 \<close> 
       using wfTI(9)[OF _ wfTI(11)] by fastforce
   qed
 next
   case (wfG_nilI \<Theta>)
   hence "GNil = (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using append_g.simps \<Gamma>.distinct GNil_append by auto
   hence "False" using \<Gamma>.distinct by auto
   then show ?case by auto
 next
   case (wfG_cons1I c1 \<Theta> \<B> G x1 b1)
   show  ?case proof(cases "\<Gamma>'=GNil")
     case True
     then show ?thesis using wfG_cons1I wfG_consI by auto
   next
     case False
     then  obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>'" using wfG_cons1I wfG_cons1I(7) GCons_eq_append_conv by auto
     hence **:" G = G' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons1I by auto
     hence " \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using  wfG_cons1I by auto
     have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x1, b1, c1)  #\<^sub>\<Gamma> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" proof(rule Wellformed.wfG_cons1I)
       show "c1 \<notin> {TRUE, FALSE}" using wfG_cons1I by auto
       show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> " using wfG_cons1I(3)[of G',OF **] wfG_cons1I by auto
       show "atom x1 \<sharp> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  using wfG_cons1I * ** fresh_replace_inside  by metis
       show "\<Theta>; \<B>; (x1, b1, TRUE)  #\<^sub>\<Gamma> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c1" using wfG_cons1I(6)[of " (x1, b1, TRUE)  #\<^sub>\<Gamma> G'"] wfG_cons1I ** by auto
       show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b1" using wfG_cons1I by auto
     qed
     thus ?thesis using * by auto
   qed
 next
   case (wfG_cons2I c1 \<Theta> \<B> G x1 b1)
    show  ?case proof(cases "\<Gamma>'=GNil")
     case True
     then show ?thesis using wfG_cons2I wfG_consI by auto
   next
     case False
     then  obtain G'::\<Gamma> where *:"(x1, b1, c1)  #\<^sub>\<Gamma> G' = \<Gamma>'" using wfG_cons2I GCons_eq_append_conv by auto
     hence **:" G = G' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I by auto
     moreover have " \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I * ** by auto
     moreover hence "atom x1 \<sharp> G' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfG_cons2I * ** fresh_replace_inside  by metis
     ultimately show  ?thesis using Wellformed.wfG_cons2I[OF wfG_cons2I(1), of \<Theta> \<B> "G'@ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  x1 b1] wfG_cons2I * ** by auto
   qed
 qed(metis  wf_intros )+
 
 lemma wf_replace_inside2:
   fixes \<Gamma>::\<Gamma> and \<Phi>::\<Phi> and \<Theta>::\<Theta> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and c''::c and c'::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b'::b and b::b and s::s  
            and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and cs::branch_s and css::branch_list
 shows 
        "\<Theta> ; \<Phi> ;  \<B> ; G ; D  \<turnstile>\<^sub>w\<^sub>f e : b' \<Longrightarrow> G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>); D \<turnstile>\<^sub>w\<^sub>f e : b'" and
        "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b \<Longrightarrow> True" and
        "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
        "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and
        "\<Theta> \<turnstile>\<^sub>w\<^sub>f \<Phi> \<Longrightarrow> True" and
        "\<Theta>; \<B>; G  \<turnstile>\<^sub>w\<^sub>f \<Delta> \<Longrightarrow>  G =  (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) \<Longrightarrow> \<Theta>; \<B>; ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c \<Longrightarrow> \<Theta> ;  \<B> ; (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) \<turnstile>\<^sub>w\<^sub>f \<Delta>" and     
        "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
        "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
 proof(nominal_induct   
           b' and b and b and b and  \<Phi> and \<Delta> and  ftq and ft 
       avoiding: \<Gamma>' c'
       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
 case (wfE_valI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v b)
   then show ?case using wf_replace_inside1 Wellformed.wfE_valI by auto
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_plusI by auto
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_leqI by auto
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b v2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_eqI by metis
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_fstI by metis
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_sndI by metis
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_concatI by auto
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case using wf_replace_inside1 Wellformed.wfE_splitI by auto
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   then show ?case using wf_replace_inside1 Wellformed.wfE_lenI by metis
 next
   case (wfE_appI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> f x b c \<tau> s v)
   then show ?case using wf_replace_inside1 Wellformed.wfE_appI by metis
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma>'' \<Delta> b' bv v \<tau> f x1 b1 c1 s)
   show ?case proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<Delta> \<close> using wfE_appPI by auto
     show \<open> \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' \<close> using wfE_appPI by auto
     show *:\<open> \<Theta>; \<B>; \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b1[bv::=b']\<^sub>b \<close> using wfE_appPI wf_replace_inside1 by auto
 
     moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>" using wfV_wf wfE_appPI by metis
     ultimately have "atom bv \<sharp>  \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>"  
       unfolding fresh_def using wfV_wf wfG_supp_rig_eq wfE_appPI Un_iff fresh_def  by metis 
 
     thus  \<open>atom bv \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>, \<Delta>, b', v, (b_of \<tau>)[bv::=b']\<^sub>b)\<close>
       using wfE_appPI  fresh_prodN by metis
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv (AF_fun_typ x1 b1 c1 \<tau> s))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
   qed
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   then show ?case using wf_replace_inside1 Wellformed.wfE_mvarI by metis
 next
   case (wfD_emptyI \<Theta> \<B> \<Gamma>)
   then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
 next
   case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI 
     by (simp add: wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfD_cons)
 next
   case (wfFTNone \<Theta> \<Phi> ft)
   then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
 next
   case (wfFTSome \<Theta> \<Phi> bv ft)
   then show ?case using wf_replace_inside1 Wellformed.wfD_emptyI by metis
 qed(auto)
 
 lemmas wf_replace_inside = wf_replace_inside1 wf_replace_inside2
 
 lemma wfC_replace_cons:
   assumes "wfG P \<B> ((x,b,c1) #\<^sub>\<Gamma>\<Gamma>)" and "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c2" 
   shows "wfC P \<B> ((x,b,c1) #\<^sub>\<Gamma>\<Gamma>) c2" 
 proof -
   have "wfC P \<B> (GNil@((x,b,c1) #\<^sub>\<Gamma>\<Gamma>)) c2" proof(rule wf_replace_inside1(2))
     show " P; \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c2 " using wfG_elim2 assms by auto
     show \<open>(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> = GNil @ (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<close> using append_g.simps by auto
     show \<open>P; \<B> ; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c1  \<close>  using wfG_elim2 assms by auto
   qed
   thus ?thesis using append_g.simps by auto
 qed
 
 lemma wfC_refl:
   assumes "wfG \<Theta> \<B> ((x, b', c') #\<^sub>\<Gamma>\<Gamma>)" 
   shows   "wfC \<Theta> \<B> ((x, b', c') #\<^sub>\<Gamma>\<Gamma>) c'"
   using wfG_wfC assms wfC_replace_cons by auto
 
 lemma wfG_wfC_inside:
   assumes " (x, b, c)  \<in> toSet G" and "wfG \<Theta> B G" 
   shows  "wfC \<Theta> B G c"
   using assms proof(induct G rule: \<Gamma>_induct)
   case GNil
   then show ?case by auto
 next
   case (GCons x' b' c' \<Gamma>')
   then consider (hd) "(x, b, c) = (x',b',c')" | (tail) "(x, b, c) \<in> toSet \<Gamma>'" using toSet.simps by auto
   then show ?case proof(cases)
     case hd
     then show ?thesis using GCons wf_weakening
       by (metis wfC_replace_cons wfG_cons_wfC)
   next
     case tail
     then show ?thesis using GCons wf_weakening 
       by (metis insert_iff insert_is_Un subsetI toSet.simps(2) wfG_cons2)
   qed
 qed
 
 lemma wfT_wf_cons3:
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom y \<sharp> (c,\<Gamma>)"
   shows  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[z::=V_var y]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma>  \<Gamma>"
 proof -
   have "\<lbrace> z : b | c \<rbrace> = \<lbrace> y : b |  (y \<leftrightarrow> z) \<bullet> c \<rbrace>" using type_eq_flip assms by auto
   moreover hence " (y \<leftrightarrow> z) \<bullet> c = c[z::=V_var y]\<^sub>c\<^sub>v" using  assms subst_v_c_def by auto
   ultimately have "\<lbrace> z : b | c \<rbrace> = \<lbrace> y : b |  c[z::=V_var y]\<^sub>c\<^sub>v \<rbrace>" by metis
   thus  ?thesis using assms wfT_wf_cons[of \<Theta> \<B> \<Gamma> y b] fresh_Pair by metis
 qed
 
 lemma wfT_wfC_cons:
   assumes "wfT P \<B> \<Gamma> \<lbrace> z1 : b  | c1 \<rbrace>" and "wfT P \<B> \<Gamma> \<lbrace> z2 : b  | c2 \<rbrace>"  and "atom x \<sharp> (c1,c2,\<Gamma>)"
   shows "wfC P \<B> ((x,b,c1[z1::=V_var x]\<^sub>v) #\<^sub>\<Gamma>\<Gamma>) (c2[z2::=V_var x]\<^sub>v)" (is "wfC P \<B> ?G ?c")
 proof -
   have eq: "\<lbrace> z2 : b  | c2 \<rbrace> = \<lbrace> x : b | c2[z2::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using type_eq_subst assms fresh_prod3 by simp
   have eq2: "\<lbrace> z1 : b  | c1 \<rbrace> = \<lbrace> x : b | c1[z1::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using type_eq_subst assms fresh_prod3 by simp
   moreover have "wfT P \<B> \<Gamma> \<lbrace> x : b  | c1[z1::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms eq2 by auto
   moreover hence "wfG P \<B> ((x,b,c1[z1::=V_var x]\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>)" using wfT_wf_cons fresh_prod3 assms by auto
   moreover have "wfT P \<B> \<Gamma> \<lbrace> x : b  | c2[z2::=V_var x]\<^sub>c\<^sub>v \<rbrace>" using assms eq by auto
   moreover hence "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>)  (c2[z2::=V_var x]\<^sub>c\<^sub>v)" using wfT_wfC assms fresh_prod3 by simp
   ultimately show ?thesis using wfC_replace_cons subst_v_c_def by simp
 qed
 
 lemma wfT_wfC2:
   fixes c::c  and x::x
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>"
   shows "\<Theta>; \<B>; (x,b,TRUE)#\<^sub>\<Gamma>\<Gamma> \<turnstile>\<^sub>w\<^sub>f c[z::=[x]\<^sup>v]\<^sub>v"
 proof(cases "x=z")
   case True
   then show ?thesis using wfT_wfC assms by auto
 next
   case False
   hence "atom x \<sharp> c" using wfT_fresh_c assms by metis
   hence "\<lbrace> x : b  | c[z::=[ x ]\<^sup>v]\<^sub>v \<rbrace> = \<lbrace> z : b | c \<rbrace>" 
     using \<tau>.eq_iff Abs1_eq_iff(3)[of x "c[z::=[ x ]\<^sup>v]\<^sub>v" z c] 
     by (metis flip_subst_v type_eq_flip)
   hence " \<Theta>; \<B>; \<Gamma>   \<turnstile>\<^sub>w\<^sub>f \<lbrace> x : b  | c[z::=[ x ]\<^sup>v]\<^sub>v \<rbrace>" using assms by metis
   thus ?thesis using wfT_wfC assms by auto
 qed
 
 lemma wfT_wfG: 
   fixes x::x and \<Gamma>::\<Gamma> and z::x and c::c and b::b
   assumes "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b | c \<rbrace>" and "atom x \<sharp> \<Gamma>" 
   shows "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x,b, c[z::=[ x ]\<^sup>v]\<^sub>v) #\<^sub>\<Gamma> \<Gamma>"
 proof - 
   have "\<Theta>; \<B>; (x, b, TRUE) #\<^sub>\<Gamma> \<Gamma>   \<turnstile>\<^sub>w\<^sub>f c[z::=[ x ]\<^sup>v]\<^sub>v" using wfT_wfC2 assms by metis
   thus ?thesis using wfG_consI assms wfT_wfB b_of.simps wfX_wfY by metis
 qed
 
 lemma wfG_replace_inside2:
   fixes \<Gamma>::\<Gamma> 
   assumes "wfG P \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
   shows "wfG P \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"
 proof - 
   have "wfC P \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" using wfG_wfC assms by auto
   thus ?thesis using wf_replace_inside1(3)[OF assms(1)] by auto
 qed
 
 lemma wfG_replace_inside_full:
   fixes \<Gamma>::\<Gamma> 
   assumes "wfG P \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>)" and "wfG P \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))"
   shows "wfG P \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>)"
 proof - 
   have "wfG P \<B> ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)" using wfG_suffix assms by auto
   thus ?thesis using wfG_replace_inside assms by auto
 qed
 
 lemma wfT_replace_inside2:
   assumes "wfT \<Theta> \<B> (\<Gamma>' @ (x, b, c')  #\<^sub>\<Gamma> \<Gamma>) t" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))"
   shows "wfT \<Theta> \<B> (\<Gamma>' @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>) t"
 proof -
   have "wfG \<Theta> \<B> (((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" using wfG_suffix assms by auto
   hence "wfC \<Theta> \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" using wfG_wfC by auto
   thus ?thesis   using wf_replace_inside assms by metis
 qed
 
 lemma wfD_unique:
   assumes "wfD P  \<B> \<Gamma> \<Delta>" and " (u,\<tau>') \<in> setD \<Delta>" and "(u,\<tau>) \<in> setD \<Delta>"
   shows "\<tau>'=\<tau>"
 using assms  proof(induct \<Delta> rule: \<Delta>_induct)
   case DNil
   then show ?case by auto
 next
   case (DCons u' t' D)
   hence *: "wfD P \<B> \<Gamma> ((u',t') #\<^sub>\<Delta> D)" using Cons by auto
   show ?case proof(cases "u=u'")
     case True
     then have "u \<notin> fst ` setD D" using wfD_elims *  by blast
     then show ?thesis using DCons by force
   next
     case False
     then show ?thesis using DCons wfD_elims *  by (metis fst_conv setD_ConsD)
   qed
 qed
 
 lemma replace_in_g_forget:
   fixes x::x
   assumes "wfG P B G"
   shows "atom x \<notin> atom_dom G \<Longrightarrow> (G[x\<longmapsto>c]) = G" and
   "atom x \<sharp> G \<Longrightarrow>  (G[x\<longmapsto>c]) = G"
 proof -
   show "atom x \<notin> atom_dom G \<Longrightarrow> G[x\<longmapsto>c] = G" by (induct G rule: \<Gamma>_induct,auto)
   thus  "atom x \<sharp> G \<Longrightarrow>  (G[x\<longmapsto>c]) = G" using wfG_x_fresh assms by simp
 qed
 
 lemma replace_in_g_fresh_single:
   fixes G::\<Gamma> and x::x
   assumes  \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G[x'\<longmapsto>c'']\<close> and "atom x \<sharp> G" and \<open>\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f G \<close>
   shows "atom x \<sharp> G[x'\<longmapsto>c'']" 
   using rig_dom_eq wfG_dom_supp assms fresh_def atom_dom.simps dom.simps by metis
 
 section \<open>Preservation of well-formedness under substitution\<close>
 
 lemma wfC_cons_switch:
   fixes c::c and c'::c
   assumes "\<Theta>; \<B>; (x, b, c)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'"
   shows "\<Theta>; \<B>; (x, b, c')  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c"
 proof -
   have *:"\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x, b, c)  #\<^sub>\<Gamma> \<Gamma>" using wfC_wf assms by auto
   hence "atom x \<sharp> \<Gamma> \<and> wfG \<Theta> \<B> \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfG_cons by auto
   hence " \<Theta>; \<B>; (x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f TRUE " using wfC_trueI wfG_cons2I by simp
   hence "\<Theta>; \<B>;(x, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>  \<turnstile>\<^sub>w\<^sub>f c'" 
     using wf_replace_inside1(2)[of \<Theta> \<B> "(x, b, c)  #\<^sub>\<Gamma> \<Gamma>" c' GNil x b c \<Gamma> TRUE] assms by auto
   hence "wfG \<Theta> \<B> ((x,b,c') #\<^sub>\<Gamma>\<Gamma>)" using wf_replace_inside1(3)[OF *, of GNil x b c \<Gamma> c'] by auto
   moreover have "wfC \<Theta> \<B> ((x,b,TRUE) #\<^sub>\<Gamma>\<Gamma>) c" proof(cases "c \<in> { TRUE, FALSE }")
     case True
     have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  \<Gamma> \<and> atom x \<sharp> \<Gamma> \<and> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b" using wfG_elims(2)[OF *] by auto
     hence "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f  (x,b,TRUE) #\<^sub>\<Gamma> \<Gamma>" using wfG_cons_TRUE by auto
     then show ?thesis using wfC_trueI wfC_falseI True by auto
   next
     case False
     then show ?thesis using wfG_elims(2)[OF *] by auto
   qed
   ultimately show  ?thesis using wfC_replace_cons by auto
 qed
 
 lemma subst_g_inside_simple:
   fixes \<Gamma>\<^sub>1::\<Gamma> and \<Gamma>\<^sub>2::\<Gamma> 
   assumes "wfG P \<B> (\<Gamma>\<^sub>1@((x,b,c) #\<^sub>\<Gamma>\<Gamma>\<^sub>2))"
   shows "(\<Gamma>\<^sub>1@((x,b,c) #\<^sub>\<Gamma>\<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v = \<Gamma>\<^sub>1[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>\<^sub>2" 
 using assms proof(induct \<Gamma>\<^sub>1 rule: \<Gamma>_induct)
   case GNil
   then show ?case using subst_gv.simps by simp
 next
   case (GCons x' b' c' G)
   hence *:"P; \<B>  \<turnstile>\<^sub>w\<^sub>f (x', b', c')  #\<^sub>\<Gamma> (G @ (x, b, c)  #\<^sub>\<Gamma> \<Gamma>\<^sub>2)" by auto
   hence "x\<noteq>x'" 
     using  GCons append_Cons  wfG_cons_fresh2[OF *] by auto
   hence "((GCons (x', b', c') G) @ (GCons (x, b, c)  \<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v  =  
          (GCons (x', b', c') (G @ (GCons (x, b, c)  \<Gamma>\<^sub>2)))[x::=v]\<^sub>\<Gamma>\<^sub>v" by auto
   also have "... =  GCons (x', b', c'[x::=v]\<^sub>c\<^sub>v) ((G @ (GCons (x, b, c)  \<Gamma>\<^sub>2))[x::=v]\<^sub>\<Gamma>\<^sub>v)"  
       using subst_gv.simps \<open>x\<noteq>x'\<close> by simp
   also have "... = (x', b', c'[x::=v]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> (G[x::=v]\<^sub>\<Gamma>\<^sub>v @  \<Gamma>\<^sub>2)" using GCons * wfG_elims by metis
   also have "... = ((x', b', c')  #\<^sub>\<Gamma> G)[x::=v]\<^sub>\<Gamma>\<^sub>v @  \<Gamma>\<^sub>2"  using subst_gv.simps \<open>x\<noteq>x'\<close>  by simp
   finally show ?case by blast
 qed
 
 lemma subst_c_TRUE_FALSE:
   fixes c::c
   assumes "c \<notin> {TRUE,FALSE}" 
   shows "c[x::=v']\<^sub>c\<^sub>v \<notin> {TRUE, FALSE}"
 using assms by(nominal_induct c rule:c.strong_induct,auto simp add: subst_cv.simps)
 
 lemma lookup_subst:
   assumes "Some (b, c) = lookup \<Gamma> x" and "x \<noteq> x'" 
   shows "\<exists>c'. Some (b,c') = lookup \<Gamma>[x'::=v']\<^sub>\<Gamma>\<^sub>v x"
 using assms proof(induct \<Gamma> rule: \<Gamma>_induct)
 case GNil
   then show ?case by auto
 next
   case (GCons x1 b1 c1 \<Gamma>1)
   then show ?case proof(cases "x1=x'")
     case True
     then show ?thesis using subst_gv.simps GCons by auto
   next
     case False
     hence  *:"((x1, b1, c1)  #\<^sub>\<Gamma> \<Gamma>1)[x'::=v']\<^sub>\<Gamma>\<^sub>v =  ((x1, b1, c1[x'::=v']\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>1[x'::=v']\<^sub>\<Gamma>\<^sub>v)" using subst_gv.simps by auto
     then show ?thesis proof(cases "x1=x")
       case True
       then show ?thesis using lookup.simps *
         using GCons.prems(1) by auto
     next
       case False
       then show ?thesis using lookup.simps *
         using GCons.prems(1)  by (simp add: GCons.hyps assms(2))
     qed
   qed
 qed
 
 lemma lookup_subst2:
   assumes "Some (b, c) = lookup (\<Gamma>'@((x',b\<^sub>1,c0[z0::=[x']\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>)) x" and "x \<noteq> x'" and
           "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (\<Gamma>'@((x',b\<^sub>1,c0[z0::=[x']\<^sup>v]\<^sub>c\<^sub>v)#\<^sub>\<Gamma>\<Gamma>))" 
   shows "\<exists>c'. Some (b,c') = lookup (\<Gamma>'[x'::=v']\<^sub>\<Gamma>\<^sub>v@\<Gamma>) x"
   using assms lookup_subst subst_g_inside by metis
 
 lemma wf_subst1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
   shows  wfV_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b        \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>;\<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b" and
          wfC_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B>;  \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v" and
           wfG_subst: "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" and
           wfT_subst: "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and
           wfCE_subst: "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f  ce[x::=v']\<^sub>c\<^sub>e\<^sub>v : b" and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
 proof(nominal_induct 
       b and c and \<Gamma> and \<tau> and ts and \<Theta> and b and  b and td 
       avoiding: x v' 
       arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1
       rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
  case (wfV_varI \<Theta> \<B> \<Gamma> b1 c1 x1)
   
   show ?case proof(cases "x1=x")
     case True
     hence "(V_var x1)[x::=v']\<^sub>v\<^sub>v = v' " using subst_vv.simps by auto
     moreover have "b' = b1" using wfV_varI True  lookup_inside_wf
       by (metis option.inject prod.inject)
     moreover have " \<Theta>; \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v' : b'" using  wfV_varI subst_g_inside_simple wf_weakening 
       append_g_toSetU sup_ge2  wfV_wf by metis
     ultimately show ?thesis by auto
   next
     case False
     hence "(V_var x1)[x::=v']\<^sub>v\<^sub>v = (V_var x1) " using subst_vv.simps by auto
     moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using wfV_varI by simp
     moreover obtain c1' where "Some (b1, c1') = lookup \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v x1"  using    wfV_varI  False  lookup_subst by metis
     ultimately show ?thesis using  Wellformed.wfV_varI[of \<Theta>  \<B> "\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" b1 c1' x1] by metis
   qed  
 next
   case (wfV_litI \<Theta> \<Gamma> l)
   then show ?case using  subst_vv.simps  wf_intros by auto
 next
   case (wfV_pairI \<Theta> \<Gamma> v1 b1 v2 b2)
   then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfV_consI s dclist \<Theta> dc x b c \<Gamma> v)
   then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfV_conspI s bv dclist \<Theta> dc x' b' c \<B> b \<Gamma> va)
   show ?case unfolding subst_vv.simps proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> and \<open>(dc, \<lbrace> x' : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     show \<open> \<Theta> ;\<B>  \<turnstile>\<^sub>w\<^sub>f b \<close> using wfV_conspI by auto
     have "atom bv \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfV_conspI by metis
     moreover have "atom bv \<sharp> va[x::=v']\<^sub>v\<^sub>v" using wfV_conspI fresh_subst_if  by simp
     ultimately show \<open>atom bv \<sharp> (\<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, b, va[x::=v']\<^sub>v\<^sub>v)\<close> unfolding fresh_prodN  using wfV_conspI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f va[x::=v']\<^sub>v\<^sub>v : b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by auto
   qed
 next
   case (wfTI z \<Theta> \<B> \<Gamma>  b c)
   have "  \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<lbrace> z : b  | c[x::=v']\<^sub>c\<^sub>v  \<rbrace>" proof
     have  \<open>\<Theta>; \<B>; ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v  \<close> 
     proof(rule  wfTI(9))
       show \<open>(z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma> = ((z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>\<^sub>1) @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2\<close> using wfTI append_g.simps by simp
       show \<open> \<Theta>; \<B>; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b' \<close> using wfTI by auto
     qed
     thus *:\<open>\<Theta>; \<B>; (z, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v  \<close> 
       using subst_gv.simps subst_cv.simps wfTI fresh_x_neq by auto
 
     have "atom z \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfTI by metis
     moreover have "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f  \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using wfTI wfX_wfY wfG_elims subst_gv.simps * by metis
     ultimately show  \<open>atom z \<sharp>  (\<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v)\<close> using wfG_fresh_x  by metis
     show \<open>  \<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b  \<close> using wfTI by auto   
   qed
   thus ?case using subst_tv.simps wfTI by auto
 next
   case (wfC_trueI \<Theta> \<Gamma>)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfC_falseI \<Theta> \<Gamma>)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfC_eqI \<Theta> \<B> \<Gamma> e1 b e2)
   show ?case proof(subst subst_cv.simps,rule)
     show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f e1[x::=v']\<^sub>c\<^sub>e\<^sub>v : b " using wfC_eqI subst_dv.simps by auto
     show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f e2[x::=v']\<^sub>c\<^sub>e\<^sub>v : b " using wfC_eqI by auto
   qed
 next
   case (wfC_conjI \<Theta> \<Gamma> c1 c2)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfC_disjI \<Theta> \<Gamma> c1 c2)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfC_notI \<Theta> \<Gamma> c1)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfC_impI \<Theta> \<Gamma> c1 c2)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfG_nilI \<Theta>)
   then show ?case using subst_cv.simps  wf_intros by auto
 next
   case (wfG_cons1I c \<Theta> \<B> \<Gamma> y b)
 
   show ?case proof(cases "x=y")
     case True
     hence "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  = \<Gamma>" using subst_gv.simps by auto
     moreover have  "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f \<Gamma>"  using  wfG_cons1I by auto
     ultimately show ?thesis by auto
   next
     case False
     have "\<Gamma>\<^sub>1 \<noteq> GNil" using wfG_cons1I False by auto
     then obtain G where "\<Gamma>\<^sub>1 = (y, b, c)  #\<^sub>\<Gamma> G" using GCons_eq_append_conv wfG_cons1I by auto
     hence *:"\<Gamma> = G @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons1I by auto
     hence  "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  =(y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps False by auto
     moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" proof(rule  Wellformed.wfG_cons1I)
       show \<open>c[x::=v']\<^sub>c\<^sub>v \<notin> {TRUE, FALSE}\<close> using wfG_cons1I subst_c_TRUE_FALSE by auto
       show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<close> using wfG_cons1I * by auto
       have "\<Gamma> = (G @ ((x, b', c') #\<^sub>\<Gamma>GNil)) @ \<Gamma>\<^sub>2" using * append_g_assoc by auto
       hence "atom y \<sharp> \<Gamma>\<^sub>2" using fresh_suffix  \<open>atom y \<sharp> \<Gamma>\<close>  by auto
       hence "atom y \<sharp> v'" using wfG_cons1I wfV_x_fresh by metis
       thus \<open>atom y \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v\<close> using fresh_subst_gv wfG_cons1I by auto
       have "((y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v = (y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps subst_cv.simps False by auto
       thus  \<open> \<Theta>; \<B>; (y, b, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v \<close> using wfG_cons1I(6)[of "(y,b,TRUE) #\<^sub>\<Gamma>G"] * subst_gv.simps 
         wfG_cons1I by fastforce
       show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b " using wfG_cons1I by auto
     qed
     ultimately show ?thesis by auto   
   qed
 next
   case (wfG_cons2I c \<Theta> \<B> \<Gamma> y b)
   show ?case proof(cases "x=y")
     case True
     hence "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  = \<Gamma>" using subst_gv.simps by auto
     moreover have  "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>"  using  wfG_cons2I by auto
     ultimately show ?thesis by auto
   next
     case False
     have "\<Gamma>\<^sub>1 \<noteq> GNil" using wfG_cons2I False by auto
     then obtain G where "\<Gamma>\<^sub>1 = (y, b, c)  #\<^sub>\<Gamma> G"  using GCons_eq_append_conv wfG_cons2I by auto
     hence *:"\<Gamma> = G @ (x, b', c')  #\<^sub>\<Gamma> \<Gamma>\<^sub>2" using wfG_cons2I by auto
     hence  "((y, b, c)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v  =(y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using subst_gv.simps False by auto
     moreover have "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f (y, b, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma>\<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" proof(rule  Wellformed.wfG_cons2I)
       show \<open>c[x::=v']\<^sub>c\<^sub>v \<in> {TRUE, FALSE}\<close> using subst_cv.simps wfG_cons2I by auto
       show \<open> \<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<close> using wfG_cons2I * by auto
       have "\<Gamma> = (G @ ((x, b', c') #\<^sub>\<Gamma>GNil)) @ \<Gamma>\<^sub>2" using * append_g_assoc by auto
       hence "atom y \<sharp> \<Gamma>\<^sub>2" using fresh_suffix wfG_cons2I by metis
       hence "atom y \<sharp> v'" using wfG_cons2I  wfV_x_fresh by metis
       thus \<open>atom y \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v\<close> using fresh_subst_gv wfG_cons2I by auto
       show "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b " using wfG_cons2I by auto
     qed
     ultimately show ?thesis by auto  
   qed
 next
   case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
    then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
   then show ?case unfolding subst_cev.simps
     using  Wellformed.wfCE_eqI by metis
 next
   case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
   then show ?case using Wellformed.wfCE_fstI subst_cev.simps by metis
 next
   case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
  then show ?case using subst_cev.simps  wf_intros by metis
 next
   case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
  then show ?case using subst_vv.simps  wf_intros by auto
 next
   case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
   then show ?case using subst_vv.simps  wf_intros by auto
 qed(metis subst_sv.simps wf_intros)+
 
 lemma wf_subst2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def
   shows    "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b    \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ;  \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  e[x::=v']\<^sub>e\<^sub>v : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta> ;\<B>  ; \<Gamma>\<^sub>2 \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta> ; \<Phi> ;  \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  s[x::=v']\<^sub>s\<^sub>v : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta>; \<Phi>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dc ; t \<turnstile>\<^sub>w\<^sub>f  subst_branchv cs x v' : b" and
          "\<Theta>; \<Phi>; \<B>; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>; \<Gamma>\<^sub>2  \<turnstile>\<^sub>w\<^sub>f v' : b'  \<Longrightarrow> \<Theta>; \<Phi>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f  subst_branchlv css x v' : b" and        
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>  \<Longrightarrow> \<Gamma>=\<Gamma>\<^sub>1@((x,b',c') #\<^sub>\<Gamma>\<Gamma>\<^sub>2) \<Longrightarrow> \<Theta>; \<B>  ; \<Gamma>\<^sub>2   \<turnstile>\<^sub>w\<^sub>f v' : b' \<Longrightarrow> \<Theta> ;  \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f  \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" and    
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
 proof(nominal_induct 
       b and b and b and b and  \<Phi> and \<Delta> and ftq and ft 
       avoiding: x v' 
       arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1
       rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct) 
   case (wfE_valI \<Theta> \<Gamma> v b)
   then show ?case using subst_vv.simps  wf_intros wf_subst1 
     by (metis subst_ev.simps(1))
 next
   case (wfE_plusI \<Theta> \<Gamma> v1 v2)
   then show ?case using subst_vv.simps  wf_intros wf_subst1 by auto
 next
   case (wfE_leqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case 
     using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_leqI 
     by auto
 next
   case (wfE_eqI \<Theta> \<Phi> \<Gamma> \<Delta> v1 b v2)
   then show ?case 
     using subst_vv.simps  subst_ev.simps subst_ev.simps wf_subst1 Wellformed.wfE_eqI     
   proof -
     show ?thesis
       by (metis (no_types) subst_ev.simps(4) wfE_eqI.hyps(1) wfE_eqI.hyps(4) wfE_eqI.hyps(5) wfE_eqI.hyps(6) wfE_eqI.hyps(7) wfE_eqI.prems(1) wfE_eqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_eqI wfV_subst) (* 31 ms *)
   qed
 next
   case (wfE_fstI \<Theta> \<Gamma> v1 b1 b2)
   then show ?case using subst_vv.simps subst_ev.simps wf_subst1 Wellformed.wfE_fstI 
   proof -
     show ?thesis
       by (metis (full_types) subst_ev.simps(5) wfE_fstI.hyps(1) wfE_fstI.hyps(4) wfE_fstI.hyps(5) wfE_fstI.prems(1) wfE_fstI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_fstI wf_subst1(1)) (* 78 ms *)
   qed
 next
   case (wfE_sndI \<Theta> \<Gamma> v1 b1 b2)
   then show ?case 
       by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_sndI wf_subst1(1)) 
 next
   case (wfE_concatI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case 
     by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_concatI wf_subst1(1)) 
 next
   case (wfE_splitI \<Theta> \<Phi> \<Gamma> \<Delta> v1 v2)
   then show ?case 
       by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_splitI wf_subst1(1)) 
 next
   case (wfE_lenI \<Theta> \<Phi> \<Gamma> \<Delta> v1)
 then show ?case 
       by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_lenI wf_subst1(1))
 next
   case (wfE_appI \<Theta> \<Phi> \<Gamma> \<Delta> f x b c \<tau> s' v)
 then show ?case 
       by (metis (full_types) subst_ev.simps wfE_sndI Wellformed.wfE_appI wf_subst1(1))
 next
    case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f1 x1 b1 c1 s1)
   show ?case proof(subst subst_ev.simps, rule)
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appPI wfX_wfY by metis
     show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfE_appPI by auto
     show "Some (AF_fundef f1 (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f1" using wfE_appPI by auto
     show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v1[x::=v']\<^sub>v\<^sub>v : b1[bv1::=b']\<^sub>b " using wfE_appPI wf_subst1 by auto
     show "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b' " using wfE_appPI by auto
     have "atom bv1 \<sharp> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v" using fresh_subst_gv_if wfE_appPI by metis
     moreover have "atom bv1 \<sharp> v1[x::=v']\<^sub>v\<^sub>v" using wfE_appPI fresh_subst_if  by simp
     moreover have "atom bv1 \<sharp> \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using wfE_appPI fresh_subst_dv_if by simp
     ultimately show "atom bv1 \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, b', v1[x::=v']\<^sub>v\<^sub>v, (b_of \<tau>1)[bv1::=b']\<^sub>b)" 
       using wfE_appPI fresh_prodN by metis
   qed
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> u \<tau>)
   have " \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f (AE_mvar u) : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v" proof
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfE_mvarI by auto
     show "\<Theta>; \<B>  ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfE_mvarI by auto
     show "(u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using wfE_mvarI subst_dv_member by auto
   qed
   thus ?case using subst_ev.simps b_of_subst by auto
 next
   case (wfD_emptyI \<Theta> \<Gamma>)
   then show ?case using subst_dv.simps  wf_intros wf_subst1 by auto
 next
    case (wfD_cons \<Theta> \<B> \<Gamma> \<Delta> \<tau> u)
   moreover hence "u \<notin> fst ` setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v" using subst_dv.simps subst_dv_iff  using subst_dv_fst_eq by presburger
   ultimately show ?case using subst_dv.simps Wellformed.wfD_cons wf_subst1 by auto
 next
   case (wfPhi_emptyI \<Theta>)
   then show ?case by auto
 next
   case (wfPhi_consI f \<Theta> \<Phi> ft)
   then show ?case by auto
 next
    case (wfS_assertI \<Theta> \<Phi> \<B> x2 c \<Gamma> \<Delta> s b)
    show ?case unfolding subst_sv.simps proof
      show \<open> \<Theta>; \<Phi>; \<B>; (x2, B_bool, c[x::=v']\<^sub>c\<^sub>v) #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
        using wfS_assertI(4)[of "(x2, B_bool, c) #\<^sub>\<Gamma> \<Gamma>\<^sub>1" x ]  wfS_assertI by auto
 
      show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f c[x::=v']\<^sub>c\<^sub>v \<close> using wfS_assertI wf_subst1 by auto
      show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close>  using wfS_assertI wf_subst1 by auto
      show \<open>atom x2 \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, c[x::=v']\<^sub>c\<^sub>v, b, s[x::=v']\<^sub>s\<^sub>v)\<close>  
       apply(unfold fresh_prodN,intro conjI) 
       apply(simp add: wfS_assertI )+
       apply(metis fresh_subst_gv_if wfS_assertI)
       apply(simp add: fresh_prodN fresh_subst_dv_if wfS_assertI)
       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_assertI)        
       apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_assertI)  
       by(simp add: fresh_prodN fresh_subst_v_if subst_v_s_def wfS_assertI)  
   qed
 next
   case (wfS_letI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> e b1 y s b2)
   have "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f LET y = (e[x::=v']\<^sub>e\<^sub>v) IN (s[x::=v']\<^sub>s\<^sub>v) : b2"  
   proof
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f e[x::=v']\<^sub>e\<^sub>v : b1 \<close> using wfS_letI by auto
     have  \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b2 \<close> 
       using wfS_letI(6) wfS_letI append_g.simps by metis 
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b1, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b2 \<close> 
       using wfS_letI subst_gv.simps by auto
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_letI by auto
     show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, e[x::=v']\<^sub>e\<^sub>v, b2)\<close> 
       apply(unfold fresh_prodN,intro conjI) 
        apply(simp add: wfS_letI )+
        apply(metis fresh_subst_gv_if wfS_letI)
        apply(simp add: fresh_prodN fresh_subst_dv_if wfS_letI)
        apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_letI)
        apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_letI)      
    done
   qed
   thus ?case using subst_sv.simps wfS_letI by auto
 next
   case (wfS_let2I \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 \<tau> y s2 b)
   have "\<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f LET y : \<tau>[x::=v']\<^sub>\<tau>\<^sub>v = (s1[x::=v']\<^sub>s\<^sub>v) IN (s2[x::=v']\<^sub>s\<^sub>v) : b"  
   proof
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s1[x::=v']\<^sub>s\<^sub>v :  b_of (\<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<close> using wfS_let2I b_of_subst by simp
     have \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s2[x::=v']\<^sub>s\<^sub>v : b \<close>  
       using wfS_let2I append_g.simps by metis
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s2[x::=v']\<^sub>s\<^sub>v : b \<close> 
       using wfS_let2I subst_gv.simps append_g.simps using b_of_subst by simp
     show \<open>   \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v  \<close> using wfS_let2I wf_subst1 by metis
     show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, s1[x::=v']\<^sub>s\<^sub>v, b, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v)\<close> 
       apply(unfold fresh_prodN,intro conjI) 
        apply(simp add: wfS_let2I )+
        apply(metis fresh_subst_gv_if wfS_let2I)
        apply(simp add: fresh_prodN fresh_subst_dv_if wfS_let2I)
        apply(simp add: fresh_prodN fresh_subst_v_if subst_v_e_def wfS_let2I)
        apply(simp add: fresh_prodN fresh_subst_v_if subst_v_\<tau>_def wfS_let2I)+
       done
   qed
   thus ?case using subst_sv.simps(3) subst_tv.simps wfS_let2I by auto
 next
   case (wfS_varI \<Theta> \<B> \<Gamma> \<tau> v u \<Phi> \<Delta> b s)
   show ?case proof(subst subst_sv.simps, auto simp add: u_fresh_xv,rule) 
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v   \<turnstile>\<^sub>w\<^sub>f \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_varI wf_subst1 by auto
     have "b_of (\<tau>[x::=v']\<^sub>\<tau>\<^sub>v) = b_of \<tau>" using b_of_subst by auto
     thus \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_varI wf_subst1 by auto
     have *:"atom u \<sharp> v'" using wfV_supp wfS_varI fresh_def by metis
     show   \<open>atom u \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v, v[x::=v']\<^sub>v\<^sub>v,  b)\<close> 
       unfolding fresh_prodN apply(auto simp add: wfS_varI)
       using wfS_varI fresh_subst_gv * fresh_subst_dv by metis+
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; (u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v)  #\<^sub>\<Delta> \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> using wfS_varI by auto
   qed
 next
   case (wfS_assignI u \<tau> \<Delta> \<Theta> \<B> \<Gamma> \<Phi> v)
   show ?case proof(subst subst_sv.simps, rule wf_intros)
     show \<open>(u, \<tau>[x::=v']\<^sub>\<tau>\<^sub>v) \<in> setD \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v\<close> using subst_dv_iff wfS_assignI  using subst_dv_fst_eq 
       using subst_dv_member by auto
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_assignI by auto
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : b_of \<tau>[x::=v']\<^sub>\<tau>\<^sub>v \<close> using wfS_assignI b_of_subst wf_subst1 by auto
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using wfS_assignI by auto
   qed
 next
   case (wfS_matchI \<Theta> \<B> \<Gamma> v tid dclist \<Delta> \<Phi> cs b)
   show ?case  proof(subst subst_sv.simps, rule wf_intros)
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f v[x::=v']\<^sub>v\<^sub>v : B_id tid \<close> using wfS_matchI wf_subst1  by auto
     show \<open>AF_typedef tid dclist \<in> set \<Theta>\<close> using wfS_matchI by auto
     show \<open> \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dclist  \<turnstile>\<^sub>w\<^sub>f subst_branchlv cs x v'  : b \<close> using wfS_matchI by simp
     show "\<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v  \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v " using wfS_matchI by auto
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> " using wfS_matchI by auto
   qed
 next
   case (wfS_branchI \<Theta> \<Phi> \<B> y \<tau> \<Gamma> \<Delta> s b tid dc)
   have " \<Theta> ; \<Phi>  ; \<B> ; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v ; tid ; dc ; \<tau> \<turnstile>\<^sub>w\<^sub>f  dc y \<Rightarrow> (s[x::=v']\<^sub>s\<^sub>v) : b" 
   proof 
     have \<open> \<Theta> ; \<Phi>  ; \<B> ; ((y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>)[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
       using wfS_branchI append_g.simps by metis
     thus \<open> \<Theta> ; \<Phi>  ; \<B> ; (y, b_of \<tau>, TRUE)  #\<^sub>\<Gamma> \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v ; \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<turnstile>\<^sub>w\<^sub>f s[x::=v']\<^sub>s\<^sub>v : b \<close> 
       using subst_gv.simps b_of_subst wfS_branchI by simp
     show \<open>atom y \<sharp> (\<Phi>, \<Theta>, \<B>, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v, \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v, \<tau>)\<close> 
        apply(unfold fresh_prodN,intro conjI) 
        apply(simp add: wfS_branchI )+
        apply(metis fresh_subst_gv_if wfS_branchI)
        apply(simp add: fresh_prodN fresh_subst_dv_if wfS_branchI)
        apply(metis fresh_subst_gv_if wfS_branchI)+      
       done
     show \<open> \<Theta>; \<B>; \<Gamma>[x::=v']\<^sub>\<Gamma>\<^sub>v \<turnstile>\<^sub>w\<^sub>f \<Delta>[x::=v']\<^sub>\<Delta>\<^sub>v \<close> using wfS_branchI by auto
   qed
   thus ?case using subst_branchv.simps wfS_branchI by auto
 next
   case (wfS_finalI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b dclist)
   then show ?case using subst_branchlv.simps wf_intros by metis
 next
   case (wfS_cons \<Theta> \<Phi> \<B> \<Gamma> \<Delta> tid dclist' cs b css dclist)
   then show ?case using subst_branchlv.simps wf_intros by metis
 
 qed(metis subst_sv.simps wf_subst1 wf_intros)+
 
 lemmas wf_subst = wf_subst1 wf_subst2
 
 lemma wfG_subst_wfV:
   assumes "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>' @ (x, b, c0[z0::=V_var x]\<^sub>c\<^sub>v)  #\<^sub>\<Gamma> \<Gamma>" and "wfV \<Theta> \<B> \<Gamma> v b"
   shows "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v @ \<Gamma> "
   using assms wf_subst subst_g_inside_simple by auto
 
 lemma wfG_member_subst:
   assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@\<Gamma>)" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x \<noteq> x1"
   shows "\<exists>c1'. (x1,b1,c1') \<in> toSet ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" 
 proof -
   consider (lhs) "(x1,b1,c1) \<in> toSet \<Gamma>'"  |  (rhs) "(x1,b1,c1) \<in> toSet \<Gamma>" using  append_g_toSetU assms by auto
   thus ?thesis  proof(cases)
     case lhs
     hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis
     hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
     then show ?thesis by auto
   next
     case rhs
     hence "(x1,b1,c1) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
     then show ?thesis by auto
   qed 
 qed
 
 lemma wfG_member_subst2:
   assumes "(x1,b1,c1) \<in> toSet (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "wfG \<Theta> \<B> (\<Gamma>'@((x,b,c) #\<^sub>\<Gamma>\<Gamma>))" and "x \<noteq> x1"
   shows "\<exists>c1'. (x1,b1,c1') \<in> toSet ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" 
 proof -
   consider (lhs) "(x1,b1,c1) \<in> toSet \<Gamma>'"  |  (rhs) "(x1,b1,c1) \<in> toSet \<Gamma>" using  append_g_toSetU assms by auto
   thus ?thesis  proof(cases)
     case lhs
     hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)" using   wfG_inside_fresh[THEN subst_gv_member_iff[OF lhs]] assms by metis
     hence "(x1,b1,c1[x::=v]\<^sub>c\<^sub>v) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
     then show ?thesis by auto
   next
     case rhs
     hence "(x1,b1,c1) \<in> toSet (\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v@\<Gamma>)"  using append_g_toSetU  by auto
     then show ?thesis by auto
   qed 
 qed
 
 lemma wbc_subst:
   fixes \<Gamma>::\<Gamma> and \<Gamma>'::\<Gamma> and v::v
   assumes "wfC \<Theta> \<B> (\<Gamma>'@((x,b,c') #\<^sub>\<Gamma>\<Gamma>)) c"  and  "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f v : b"
   shows "\<Theta>; \<B>; ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>) \<turnstile>\<^sub>w\<^sub>f c[x::=v]\<^sub>c\<^sub>v" 
 proof - 
   have "(\<Gamma>'@((x,b,c') #\<^sub>\<Gamma>\<Gamma>))[x::=v]\<^sub>\<Gamma>\<^sub>v = ((\<Gamma>'[x::=v]\<^sub>\<Gamma>\<^sub>v)@\<Gamma>)" using assms subst_g_inside_simple wfC_wf by metis
   thus ?thesis  using wf_subst1(2)[OF assms(1) _ assms(2)] by metis
 qed
 
 lemma wfG_inside_fresh_suffix:
   assumes "wfG P B (\<Gamma>'@(x,b,c) #\<^sub>\<Gamma>\<Gamma>)"
   shows "atom x \<sharp> \<Gamma>"
 proof -
   have "wfG P B ((x,b,c) #\<^sub>\<Gamma>\<Gamma>)"  using wfG_suffix assms by auto
   thus ?thesis  using wfG_elims by metis
 qed
 
 lemmas wf_b_subst_lemmas = subst_eb.simps wf_intros 
     forget_subst subst_b_b_def subst_b_v_def subst_b_ce_def fresh_e_opp_all subst_bb.simps wfV_b_fresh ms_fresh_all(6)
 
 lemma wf_b_subst1:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def
             and cs::branch_s and css::branch_list
   shows  "\<Theta> ; B'  ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b'  \<Longrightarrow> {|bv|} = B'   \<Longrightarrow> \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b  \<Longrightarrow> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  v[bv::=b]\<^sub>v\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b" and
          "\<Theta> ; B' ;  \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow>  {|bv|} = B' \<Longrightarrow> \<Theta> ;  B \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow> \<Theta> ; B ;  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  c[bv::=b]\<^sub>c\<^sub>b" and
          "\<Theta> ;  B' \<turnstile>\<^sub>w\<^sub>f \<Gamma>           \<Longrightarrow> {|bv|} = B'      \<Longrightarrow>  \<Theta> ; B \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> \<Theta> ; B \<turnstile>\<^sub>w\<^sub>f  \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" and
          "\<Theta> ;  B' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>        \<Longrightarrow> {|bv|} = B'  \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and        
          "\<Theta> ;  B'  \<turnstile>\<^sub>w\<^sub>f b' \<Longrightarrow>  {|bv|} = B' \<Longrightarrow>  \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f  b \<Longrightarrow>  \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b " and        
          "\<Theta> ;  B' ;  \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f  b  \<Longrightarrow> \<Theta> ;  B  ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  ce[bv::=b]\<^sub>c\<^sub>e\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b"  and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
 proof(nominal_induct 
       b' and c and \<Gamma> and \<tau> and ts and \<Theta> and b' and  b' and td 
       avoiding: bv b B
      rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfB_intI \<Theta> \<B>)
   then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfB_boolI \<Theta> \<B>)
  then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfB_unitI \<Theta> \<B>)
   then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfB_bitvecI \<Theta> \<B>)
   then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfB_pairI \<Theta> \<B> b1 b2)
   then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfB_consI \<Theta> s dclist \<B>)
   then show ?case using subst_bb.simps Wellformed.wfB_consI by simp
 next
   case (wfB_appI \<Theta> ba s bva dclist \<B>)
   then show ?case using subst_bb.simps Wellformed.wfB_appI forget_subst wfB_supp 
     by (metis bot.extremum_uniqueI ex_in_conv fresh_def subst_b_b_def supp_empty_fset)
 next
   case (wfV_varI \<Theta> \<B>1 \<Gamma> b1 c x)
   show ?case unfolding subst_vb.simps proof
     show "\<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b " using wfV_varI by auto
     show "Some (b1[bv::=b]\<^sub>b\<^sub>b, c[bv::=b]\<^sub>c\<^sub>b) = lookup \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b x" using subst_b_lookup wfV_varI by simp
   qed
 next
   case (wfV_litI \<Theta> \<B> \<Gamma> l)
   then show ?case using Wellformed.wfV_litI subst_b_base_for_lit by simp
 next
   case (wfV_pairI \<Theta> \<B>1 \<Gamma> v1 b1 v2 b2)
   show ?case unfolding subst_vb.simps proof(subst subst_bb.simps,rule)
     show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv::=b]\<^sub>b\<^sub>b" using wfV_pairI by simp
     show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v2[bv::=b]\<^sub>v\<^sub>b : b2[bv::=b]\<^sub>b\<^sub>b " using wfV_pairI by simp
   qed
 next
   case (wfV_consI s dclist \<Theta> dc x b' c \<B>' \<Gamma> v) 
   show ?case unfolding subst_vb.simps proof(subst subst_bb.simps, rule  Wellformed.wfV_consI) 
     show 1:"AF_typedef s dclist \<in> set \<Theta>" using wfV_consI by auto
     show 2:"(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist"  using wfV_consI by auto
     have "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b"  using wfV_consI by auto
     moreover hence "supp b' = {}" using 1 2 wfTh_lookup_supp_empty \<tau>.supp wfX_wfY by blast
     moreover hence  "b'[bv::=b]\<^sub>b\<^sub>b = b'" using  forget_subst subst_bb_def fresh_def       by (metis empty_iff subst_b_b_def)
     ultimately show  "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'" using wfV_consI by simp
   qed
 next
   case (wfV_conspI s bva dclist \<Theta> dc x b' c \<B>' ba \<Gamma> v)
   have *:"atom bv \<sharp> b'" using  wfTh_poly_supp_b[of s bva dclist \<Theta> dc x b' c] fresh_def wfX_wfY \<open>atom bva \<sharp> bv\<close> 
     by (metis insert_iff not_self_fresh singleton_insert_inj_eq' subsetI subset_antisym wfV_conspI wfV_conspI.hyps(4) wfV_conspI.prems(2))
   show ?case unfolding subst_vb.simps subst_bb.simps proof
     show \<open>AF_typedef_poly s bva dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
     show \<open>(dc, \<lbrace> x : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     thus \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f ba[bv::=b]\<^sub>b\<^sub>b \<close> using wfV_conspI by metis
     have "atom bva \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using fresh_subst_if subst_b_\<Gamma>_def wfV_conspI by metis
     moreover have "atom bva \<sharp> ba[bv::=b]\<^sub>b\<^sub>b"  using fresh_subst_if subst_b_b_def wfV_conspI by metis
     moreover have "atom bva \<sharp> v[bv::=b]\<^sub>v\<^sub>b"  using fresh_subst_if subst_b_v_def wfV_conspI by metis 
     ultimately show \<open>atom bva \<sharp> (\<Theta>, B, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, ba[bv::=b]\<^sub>b\<^sub>b, v[bv::=b]\<^sub>v\<^sub>b)\<close> 
       unfolding fresh_prodN using wfV_conspI fresh_def supp_fset by auto 
     show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'[bva::=ba[bv::=b]\<^sub>b\<^sub>b]\<^sub>b\<^sub>b \<close> 
       using wfV_conspI  subst_bb_commute[of bv b' bva ba b] * wfV_conspI by metis
   qed
 next
   case (wfTI z \<Theta> \<B>' \<Gamma>'  b' c)
   show ?case proof(subst subst_tb.simps, rule Wellformed.wfTI)
     show "atom z \<sharp>  (\<Theta>, B, \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b)" using wfTI   subst_g_b_x_fresh by simp
     show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b " using wfTI by auto
     show "\<Theta> ;  B ; (z, b'[bv::=b]\<^sub>b\<^sub>b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c[bv::=b]\<^sub>c\<^sub>b " using wfTI by simp
   qed
 next
   case (wfC_eqI \<Theta> \<B>' \<Gamma> e1 b' e2)
   thus ?case using Wellformed.wfC_eqI subst_db.simps  subst_cb.simps wfC_eqI by metis
 next
   case (wfG_nilI \<Theta> \<B>')
   then show ?case using Wellformed.wfG_nilI subst_gb.simps by simp
 next
   case (wfG_cons1I c' \<Theta> \<B>' \<Gamma>' x b')
   show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons1I)
     show "c'[bv::=b]\<^sub>c\<^sub>b \<notin> {TRUE, FALSE}" using wfG_cons1I(1)
       by(nominal_induct c' rule: c.strong_induct,auto+) 
     show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b "  using wfG_cons1I by auto
     show "atom x \<sharp> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b"  using wfG_cons1I subst_g_b_x_fresh by auto
     show "\<Theta> ;  B ; (x, b'[bv::=b]\<^sub>b\<^sub>b, TRUE)  #\<^sub>\<Gamma> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f c'[bv::=b]\<^sub>c\<^sub>b"  using wfG_cons1I by auto
     show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b "  using wfG_cons1I by auto
   qed   
 next
   case (wfG_cons2I c' \<Theta> \<B>' \<Gamma>' x b')
   show ?case proof(subst subst_gb.simps, rule Wellformed.wfG_cons2I)
     show "c'[bv::=b]\<^sub>c\<^sub>b \<in> {TRUE, FALSE}" using wfG_cons2I by auto
     show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b "  using wfG_cons2I by auto
     show "atom x \<sharp> \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b"  using wfG_cons2I subst_g_b_x_fresh by auto
     show "\<Theta> ;  B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b "  using wfG_cons2I by auto
   qed
 next
   case (wfCE_valI \<Theta> \<B> \<Gamma> v b)
   then show ?case using subst_ceb.simps wf_intros wfX_wfY   
     by (metis wf_b_subst_lemmas wfCE_b_fresh)
 next
   case (wfCE_plusI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
     by metis
 next
   case (wfCE_leqI \<Theta> \<B> \<Gamma> v1 v2)
   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
     by metis
 next
   case (wfCE_eqI \<Theta> \<B> \<Gamma> v1 b v2)
   then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY   
     by metis
 next
   case (wfCE_fstI \<Theta> \<B> \<Gamma> v1 b1 b2)
    then show ?case 
      by (metis (no_types) subst_bb.simps(5) subst_ceb.simps(3) wfCE_fstI.hyps(2) 
         wfCE_fstI.prems(1) wfCE_fstI.prems(2) Wellformed.wfCE_fstI) 
 next
   case (wfCE_sndI \<Theta> \<B> \<Gamma> v1 b1 b2)
   then show ?case 
      by (metis (no_types) subst_bb.simps(5) subst_ceb.simps wfCE_sndI.hyps(2) 
         wfCE_sndI wfCE_sndI.prems(2) Wellformed.wfCE_sndI) 
 next
   case (wfCE_concatI \<Theta> \<B> \<Gamma> v1 v2)
    then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  
    proof -
      show ?thesis
        using wfCE_concatI.hyps(2) wfCE_concatI.hyps(4) wfCE_concatI.prems(1) wfCE_concatI.prems(2) 
            Wellformed.wfCE_concatI by auto (* 46 ms *)
    qed
 next
   case (wfCE_lenI \<Theta> \<B> \<Gamma> v1)
    then show ?case using  subst_bb.simps subst_ceb.simps wf_intros wfX_wfY wf_b_subst_lemmas wfCE_b_fresh  by metis
 qed(auto simp add: wf_intros)
 
 lemma wf_b_subst2:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and s::s and b'::b and ce::ce and td::type_def
             and cs::branch_s and css::branch_list
   shows  "\<Theta> ; \<Phi> ;  B' ;  \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f e : b'    \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f  b  \<Longrightarrow> \<Theta> ; \<Phi> ;  B  ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ;  \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  e[bv::=b]\<^sub>e\<^sub>b : b'[bv::=b]\<^sub>b\<^sub>b" and
          "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> \<turnstile>\<^sub>w\<^sub>f s : b   \<Longrightarrow> True" and
          "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> ; tid ; dc ; t  \<turnstile>\<^sub>w\<^sub>f cs : b \<Longrightarrow> True" and
          "\<Theta> ; \<Phi> ;  \<B> ; \<Gamma> ; \<Delta> ; tid ; dclist \<turnstile>\<^sub>w\<^sub>f css : b \<Longrightarrow> True" and      
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f (\<Phi>::\<Phi>) \<Longrightarrow> True " and
          "\<Theta> ;  B' ; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<Delta>   \<Longrightarrow> {|bv|} = B' \<Longrightarrow> \<Theta> ; B   \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> \<Theta> ;  B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f  \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" and      
          "\<Theta> ; \<Phi>   \<turnstile>\<^sub>w\<^sub>f ftq \<Longrightarrow> True" and
          "\<Theta> ; \<Phi>  ; \<B> \<turnstile>\<^sub>w\<^sub>f ft \<Longrightarrow>   True"
 proof(nominal_induct 
       b' and b and b and b and \<Phi> and \<Delta> and  ftq and ft 
       avoiding: bv b B
 rule:wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.strong_induct)
   case (wfE_valI \<Theta>' \<Phi>' \<B>' \<Gamma>' \<Delta>' v' b')
   then show ?case unfolding subst_vb.simps subst_eb.simps using wf_b_subst1(1) Wellformed.wfE_valI  by auto    
 next
   case (wfE_plusI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case unfolding subst_eb.simps  
       using wf_b_subst_lemmas wf_b_subst1(1)  Wellformed.wfE_plusI 
     proof -
       have "\<forall>b ba v g f ts. (( ts ; f ; g[bv::=ba]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=ba]\<^sub>v\<^sub>b : b[bv::=ba]\<^sub>b\<^sub>b) \<or> \<not> ts ; \<B> ; g \<turnstile>\<^sub>w\<^sub>f v : b ) \<or> \<not> ts ; f \<turnstile>\<^sub>w\<^sub>f ba"
         using wfE_plusI.prems(1) wf_b_subst1(1) by force (* 0.0 ms *)
       then show "\<Theta> ; \<Phi> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f [ plus v1[bv::=b]\<^sub>v\<^sub>b v2[bv::=b]\<^sub>v\<^sub>b ]\<^sup>e : B_int[bv::=b]\<^sub>b\<^sub>b"
    
         by (metis wfE_plusI.hyps(1) wfE_plusI.hyps(4) wfE_plusI.hyps(5) wfE_plusI.hyps(6) wfE_plusI.prems(1) wfE_plusI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_plusI wf_b_subst_lemmas(86))
     qed
 next
   case (wfE_leqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
    then show ?case unfolding subst_eb.simps  
      using wf_b_subst_lemmas wf_b_subst1  Wellformed.wfE_leqI       
    proof -
      have "\<And>ts f b ba g v. \<not> (ts ; f \<turnstile>\<^sub>w\<^sub>f b) \<or> \<not> (ts ; {|ba|} ; g \<turnstile>\<^sub>w\<^sub>f v : B_int) \<or> (ts ; f ; g[ba::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[ba::=b]\<^sub>v\<^sub>b : B_int)"
        by (metis wf_b_subst1(1) wf_b_subst_lemmas(86)) (* 46 ms *)
      then show "\<Theta> ; \<Phi> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f [ leq v1[bv::=b]\<^sub>v\<^sub>b v2[bv::=b]\<^sub>v\<^sub>b ]\<^sup>e : B_bool[bv::=b]\<^sub>b\<^sub>b"
        by (metis (no_types) wfE_leqI.hyps(1) wfE_leqI.hyps(4) wfE_leqI.hyps(5) wfE_leqI.hyps(6) wfE_leqI.prems(1) wfE_leqI.prems(2) wfE_wfS_wfCS_wfCSS_wfPhi_wfD_wfFTQ_wfFT.wfE_leqI wf_b_subst_lemmas(87)) (* 46 ms *)
    qed   
 next
   case (wfE_eqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 bb v2)
   show ?case unfolding subst_eb.simps subst_bb.simps proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfX_wfY wfE_eqI by metis
     show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<close> using wfX_wfY wfE_eqI by metis
     show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : bb \<close> using subst_bb.simps wfE_eqI 
-      by (metis (no_types, hide_lams) empty_iff insert_iff wf_b_subst1(1))
+      by (metis (no_types, opaque_lifting) empty_iff insert_iff wf_b_subst1(1))
     show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v2[bv::=b]\<^sub>v\<^sub>b : bb \<close> using wfX_wfY wfE_eqI       
       by (metis insert_iff singleton_iff wf_b_subst1(1) wf_b_subst_lemmas(86) wf_b_subst_lemmas(87) wf_b_subst_lemmas(90))
     show \<open>bb \<in> {B_bool, B_int, B_unit}\<close> using wfE_eqI by auto
   qed     
 next
   case (wfE_fstI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(84) wf_b_subst1(1)  Wellformed.wfE_fstI         
     by (metis wf_b_subst_lemmas(89))
 next
   case (wfE_sndI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 b1 b2)
   then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_sndI 
   by (metis wf_b_subst_lemmas(89))
 next
   case (wfE_concatI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
 then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_concatI  
   by (metis wf_b_subst_lemmas(91))
 next
   case (wfE_splitI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1 v2)
   then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_splitI    
     by (metis wf_b_subst_lemmas(89) wf_b_subst_lemmas(91))
 next
   case (wfE_lenI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> v1)
   then show ?case unfolding subst_eb.simps   using wf_b_subst_lemmas(86) wf_b_subst1(1)  Wellformed.wfE_lenI  
     by (metis wf_b_subst_lemmas(91) wf_b_subst_lemmas(89))
 next
   case (wfE_appI \<Theta> \<Phi> \<B>' \<Gamma> \<Delta> f x b' c \<tau> s v)
   hence bf: "atom bv \<sharp> b'" using wfPhi_f_simple_wfT wfT_supp bv_not_in_dom_g  wfPhi_f_simple_supp_b fresh_def by fast
   hence bseq: "b'[bv::=b]\<^sub>b\<^sub>b = b'" using subst_bb.simps wf_b_subst_lemmas by metis
   have "\<Theta> ; \<Phi>  ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f (AE_app f (v[bv::=b]\<^sub>v\<^sub>b)) : (b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b))" 
   proof
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi>" using wfE_appI by auto
     show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wfE_appI by simp 
     have "atom bv \<sharp> \<tau>" using wfPhi_f_simple_wfT[OF wfE_appI(5) wfE_appI(1),THEN wfT_supp]  bv_not_in_dom_g fresh_def by force
     hence " \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b = \<tau>"  using forget_subst subst_b_\<tau>_def by metis
     thus  "Some (AF_fundef f (AF_fun_typ_none (AF_fun_typ x b' c \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b s))) = lookup_fun \<Phi> f" using wfE_appI by simp
     show "\<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v[bv::=b]\<^sub>v\<^sub>b : b'" using wfE_appI bseq wf_b_subst1 by metis
   qed
   then show ?case using subst_eb.simps b_of_subst_bb_commute by simp
 next
   case (wfE_appPI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> b' bv1 v1 \<tau>1 f x1 b1 c1 s1)
   then have *: "atom bv \<sharp> b1" using wfPhi_f_supp(1)  wfE_appPI(7,11) 
       by (metis fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps(1))
   have "\<Theta> ; \<Phi>  ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b ; \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<turnstile>\<^sub>w\<^sub>f AE_appP f b'[bv::=b]\<^sub>b\<^sub>b (v1[bv::=b]\<^sub>v\<^sub>b) : (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b"
   proof
     show \<open> \<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> \<close> using wfE_appPI by auto
     show \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b \<close> using wfE_appPI by auto
     show \<open> \<Theta> ; B  \<turnstile>\<^sub>w\<^sub>f b'[bv::=b]\<^sub>b\<^sub>b \<close> using wfE_appPI wf_b_subst1 by auto
     have "atom bv1 \<sharp> \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b" using fresh_subst_if subst_b_\<Gamma>_def wfE_appPI by metis
     moreover have "atom bv1 \<sharp> b'[bv::=b]\<^sub>b\<^sub>b"  using fresh_subst_if subst_b_b_def wfE_appPI by metis
     moreover have "atom bv1 \<sharp> v1[bv::=b]\<^sub>v\<^sub>b"  using fresh_subst_if subst_b_v_def wfE_appPI by metis 
     moreover have "atom bv1 \<sharp> \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" using fresh_subst_if subst_b_\<Delta>_def wfE_appPI by metis 
     moreover have "atom bv1 \<sharp> (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b\<^sub>b" using fresh_subst_if subst_b_b_def wfE_appPI by metis 
     ultimately show "atom bv1 \<sharp> (\<Phi>, \<Theta>, B, \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b, \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b, b'[bv::=b]\<^sub>b\<^sub>b, v1[bv::=b]\<^sub>v\<^sub>b, (b_of \<tau>1)[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b)"
       using wfE_appPI using fresh_def fresh_prodN subst_b_b_def by metis
     show \<open>Some (AF_fundef f (AF_fun_typ_some bv1 (AF_fun_typ x1 b1 c1 \<tau>1 s1))) = lookup_fun \<Phi> f\<close> using wfE_appPI by auto
 
     have  \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv1::=b']\<^sub>b[bv::=b]\<^sub>b\<^sub>b \<close>  
       using wfE_appPI  subst_b_b_def * wf_b_subst1 by metis
     thus  \<open> \<Theta> ; B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f v1[bv::=b]\<^sub>v\<^sub>b : b1[bv1::=b'[bv::=b]\<^sub>b\<^sub>b]\<^sub>b \<close> 
        using  subst_bb_commute subst_b_b_def *  by auto
   qed
   moreover have "atom bv \<sharp> b_of \<tau>1" proof -
     have "supp  (b_of \<tau>1) \<subseteq> { atom bv1 }" using wfPhi_f_poly_supp_b_of_t
       using b_of.simps  wfE_appPI  wfPhi_f_supp(5) by simp
     thus ?thesis using  wfE_appPI 
       fresh_def fresh_finsert singleton_iff subsetD fresh_def supp_at_base wfE_appPI.hyps by metis
   qed
   ultimately show ?case using subst_eb.simps(3) subst_bb_commute subst_b_b_def * by simp
 next
   case (wfE_mvarI \<Theta> \<Phi> \<B>' \<Gamma> \<Delta> u \<tau>)
 
   have "\<Theta> ; \<Phi>  ;  B ; subst_gb  \<Gamma> bv b ; subst_db  \<Delta> bv b \<turnstile>\<^sub>w\<^sub>f (AE_mvar u)[bv::=b]\<^sub>e\<^sub>b : (b_of (\<tau>[bv::=b]\<^sub>\<tau>\<^sub>b))" 
   proof(subst subst_eb.simps,rule Wellformed.wfE_mvarI)
     show "\<Theta>  \<turnstile>\<^sub>w\<^sub>f \<Phi> "  using wfE_mvarI by simp
     show "\<Theta> ;  B ; \<Gamma>[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b"  using wfE_mvarI by metis
     show "(u, \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b) \<in> setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" 
       using wfE_mvarI subst_db.simps set_insert subst_d_b_member by simp
   qed
   thus  ?case using  b_of_subst_bb_commute by auto
 
 next
   case (wfS_seqI \<Theta> \<Phi> \<B> \<Gamma> \<Delta> s1 s2 b)
   then show ?case using subst_bb.simps wf_intros wfX_wfY   by metis
 next
   case (wfD_emptyI \<Theta> \<B>' \<Gamma>)
   then show ?case using subst_db.simps Wellformed.wfD_emptyI wf_b_subst1 by simp
 next
   case (wfD_cons \<Theta> \<B>' \<Gamma>' \<Delta> \<tau> u)
   show ?case proof(subst subst_db.simps, rule Wellformed.wfD_cons )
     show "\<Theta> ;  B ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b \<turnstile>\<^sub>w\<^sub>f \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b " using wfD_cons by auto
     show "\<Theta> ;  B ; \<Gamma>'[bv::=b]\<^sub>\<Gamma>\<^sub>b   \<turnstile>\<^sub>w\<^sub>f \<tau>[bv::=b]\<^sub>\<tau>\<^sub>b  "  using wfD_cons wf_b_subst1 by auto
     show "u \<notin> fst ` setD \<Delta>[bv::=b]\<^sub>\<Delta>\<^sub>b" using wfD_cons subst_b_lookup_d by metis
   qed    
 next
   case (wfS_assertI \<Theta> \<Phi> \<B> x c \<Gamma> \<Delta> s b)
   show ?case by auto
 qed(auto)
 
 lemmas wf_b_subst = wf_b_subst1 wf_b_subst2
 
 lemma wfT_subst_wfT:
   fixes \<tau>::\<tau> and b'::b and bv::bv 
   assumes "\<Theta> ; {|bv|} ; (x,b,c) #\<^sub>\<Gamma>GNil   \<turnstile>\<^sub>w\<^sub>f \<tau>" and "\<Theta> ; B \<turnstile>\<^sub>w\<^sub>f b'"
   shows "\<Theta> ;  B ; (x,b[bv::=b']\<^sub>b\<^sub>b,c[bv::=b']\<^sub>c\<^sub>b) #\<^sub>\<Gamma>GNil  \<turnstile>\<^sub>w\<^sub>f  (\<tau>[bv::=b']\<^sub>\<tau>\<^sub>b)"
 proof - 
   have  "\<Theta> ;  B ; ((x,b,c) #\<^sub>\<Gamma>GNil)[bv::=b']\<^sub>\<Gamma>\<^sub>b  \<turnstile>\<^sub>w\<^sub>f  (\<tau>[bv::=b']\<^sub>\<tau>\<^sub>b)"
     using wf_b_subst assms by metis
   thus ?thesis using subst_gb.simps wf_b_subst_lemmas wfCE_b_fresh  by metis
 qed
 
 lemma wf_trans:
   fixes \<Gamma>::\<Gamma> and  \<Gamma>'::\<Gamma> and v::v and e::e and c::c and \<tau>::\<tau> and ts::"(string*\<tau>) list" and \<Delta>::\<Delta> and b::b and ftq::fun_typ_q and ft::fun_typ and ce::ce and td::type_def and s::s
           and cs::branch_s and css::branch_list and \<Theta>::\<Theta>
   shows  "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f v : b'        \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G  \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2  \<Longrightarrow>  \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f v : b'" and
           "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f  c           \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2 \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c" and
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f \<Gamma>                \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f \<tau>            \<Longrightarrow> True" and
          "\<Theta>; \<B>; \<Gamma>  \<turnstile>\<^sub>w\<^sub>f ts \<Longrightarrow> True" and 
          "\<turnstile>\<^sub>w\<^sub>f \<Theta> \<Longrightarrow>True" and      
          "\<Theta>; \<B> \<turnstile>\<^sub>w\<^sub>f b \<Longrightarrow> True " and       
          "\<Theta>; \<B>; \<Gamma> \<turnstile>\<^sub>w\<^sub>f ce : b'    \<Longrightarrow> \<Gamma> = (x, b, c2)  #\<^sub>\<Gamma> G \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f c2  \<Longrightarrow> \<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G   \<turnstile>\<^sub>w\<^sub>f ce : b' " and
          "\<Theta>  \<turnstile>\<^sub>w\<^sub>f td \<Longrightarrow>   True"
 proof(nominal_induct
      b' and c and \<Gamma> and \<tau> and ts and \<Theta> and  b and  b' and td 
      avoiding: c1
    arbitrary: \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 and  \<Gamma>\<^sub>1 and \<Gamma>\<^sub>1 
    rule:wfV_wfC_wfG_wfT_wfTs_wfTh_wfB_wfCE_wfTD.strong_induct)
   case (wfV_varI \<Theta> \<B> \<Gamma> b' c' x')
   have wbg: "\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f (x, b, c1)  #\<^sub>\<Gamma> G " using wfC_wf wfV_varI by simp
   show ?case proof(cases "x=x'")
     case True
     have "Some (b', c1) = lookup ((x, b, c1)  #\<^sub>\<Gamma> G) x'" using lookup.simps wfV_varI  using True by auto
     then show ?thesis using Wellformed.wfV_varI wbg by simp
   next
     case False
     then have "Some (b', c') = lookup ((x, b, c1)  #\<^sub>\<Gamma> G) x'" using lookup.simps wfV_varI 
       by simp
     then show ?thesis using Wellformed.wfV_varI wbg by simp
   qed 
 next
  case (wfV_conspI s bv dclist \<Theta> dc x1 b' c \<B> b1 \<Gamma> v)
   show ?case proof
     show \<open>AF_typedef_poly s bv dclist \<in> set \<Theta>\<close> using wfV_conspI by auto
     show \<open>(dc, \<lbrace> x1 : b'  | c \<rbrace>) \<in> set dclist\<close> using wfV_conspI by auto
     show \<open>\<Theta>; \<B>  \<turnstile>\<^sub>w\<^sub>f b1 \<close> using wfV_conspI by auto
     show \<open>atom bv \<sharp> (\<Theta>, \<B>, (x, b, c1)  #\<^sub>\<Gamma> G, b1, v)\<close> unfolding fresh_prodN fresh_GCons using wfV_conspI  fresh_prodN fresh_GCons by simp
     show \<open>\<Theta>; \<B>; (x, b, c1)  #\<^sub>\<Gamma> G \<turnstile>\<^sub>w\<^sub>f v : b'[bv::=b1]\<^sub>b\<^sub>b\<close> using wfV_conspI by auto
   qed
 qed( (auto | metis wfC_wf wf_intros) +)
 
 
 end
\ No newline at end of file